Re: audit deletions in shared folders

Auditing is recorded on the machine where access is attempted/audited,
which for a share means the sharing-out machine.
Auditing can be set with GPO but you need to be very careful, especially
if you use the W2k version of the tools.

"kdbwtg" <kdbwtg@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:70A27FFE-8C83-4C35-B917-E8D764FCE4F7@xxxxxxxxxxxxxxxx
This is on a Windws 2000 AD network, can I do this accross the domain and
have them all report to one computer for multiple servers?

"Roger Abell [MVP]" wrote:

You need to set auditing (for delete only) on the underlying NTFS
storage.
http://search.microsoft.com/results.aspx?mkt=en-US&setlang=en-US&q=ntfs+audit

--
Roger Abell
Microsoft MVP (Windows Server : Security)

"kdbwtg" <kdbwtg@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:10CAFE8F-221C-47CF-814D-A19DA41DD494@xxxxxxxxxxxxxxxx
I need to know how to turn on and configure auditing so that I am only
monitoring the deletions of items in shared folders on the servers.
Can
anyone help?

Thanks.





.

Relevant Pages

  • Re: Auditing GPO Win2000
    ... You can audit auditing on any W2K computer either in Local Security Policy or via a ... GPO in the container where the computer resides. ... Auditing is part of "computer" configuration.--- Steve ... > All my meber servers are in an OU called Terminal Servers. ...
    (microsoft.public.win2000.group_policy)
  • Auditing GPO Win2000
    ... default domian policy but how about auditing. ... All my meber servers are in an OU called Terminal Servers. ... Do I need to enable Auditing on GPOs and link them to the ... or simply if I apply ther GPO to the Domain Controller OU, ...
    (microsoft.public.win2000.group_policy)
  • RE: Mystery deleted directories
    ... Is there any way to set at the GPO an auditing policy on JUST shares ... throughout all of my servers? ... > - file auditing is set up on the DC in the GPO ...
    (microsoft.public.win2000.file_system)
  • Re: HELP - File Auditing
    ... > We have performed all of the below on many servers with no results... ... Auditing must be enabled on ... > individual objects for audit events to be logged. ... >>audit policy setting take effect only when the policy ...
    (microsoft.public.win2000.security)
  • Re: HELP - File Auditing
    ... We have performed all of the below on many servers with no results... ... Enabling either success or failure event auditing does ... individual objects for audit events to be logged. ... >audit policy setting take effect only when the policy ...
    (microsoft.public.win2000.security)