Cannot see audit events in security log

From: Frank Thynne (fthynne_at_elmplace.co.uk)
Date: 11/22/04 

Date: 21 Nov 2004 16:30:15 -0800

My client has a stand-alone Windows 2000 Professional computer. We are
trying to establish auditing on a folder and its contents. We have
turned on auditing in local policy and enabled success and failure
auditing on objects. In the advanced section of the security
properties of the folder we have set auditing for the Everyone group
and specified that the property will be propagated to files and
folders contained in it. We have verified that the property is
inherited by a file copied into the folder.

After doing those things, and accessing a file in the audited folder,
we do not see anything relevant in the Security Event Log. I must be
missing something obvious, but I do not know what it is! Can anyone
advise?

Relevant Pages

  • Re: Autoexec.nt file missing?
    ... you can't enable Auditing on a computer running Home Edition. ... You must specify what to audit. ... >> example, a file, folder, registry key, printer, and so forth-that has its ...
    (microsoft.public.windowsxp.newusers)
  • Re: Change to folder permissions - What event is logged?
    ... Based on my research, after you enabled Change Permission auditing, if ... double-click "Audit object access". ... locate the file or folder you want to audit. ... Select the Successful or Failed check boxes for Change Permission action ...
    (microsoft.public.windows.server.sbs)
  • RE: Change to folder permissions - What event is logged?
    ... Based on my research, after you enabled Change Permission auditing, if ... double-click "Audit object access". ... locate the file or folder you want to audit. ... Select the Successful or Failed check boxes for Change Permission action ...
    (microsoft.public.windows.server.sbs)
  • RE: Monitor File Access, Change or Delete
    ... folder with auditing for Windows Server 2003. ... Locate the file or folder that you want to audit. ... and then click the Auditing tab. ...
    (microsoft.public.windows.server.sbs)
  • Re: Audit deletion of a folder
    ... Auditing writes to the security event log, no way that I know of around ... one specific machine or folder? ... But the object access should not be> enabled in Domain Controller Security Policy. ...
    (microsoft.public.win2000.group_policy)