Re: Tracking access to folder

Thanks for the information, very helpful


"Steven L Umbach" <n9rou@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:ubSkPh7lGHA.4808@xxxxxxxxxxxxxxxxxxxxxxx
Enabling auditing of object access will generate a lot of seemingly
unrelated events but that just goes with the territory. When configuring
auditing for a folder be sure just to specify the users or a group
containing the users you want to track instead of users or everyone. Then
audit only the permissions you want to track instead of every permission
and the type of permission whether it be success or failure. List and read
permissions will generate a lot of object access events for success. What
can really help is to use the free Event Comb from Microsoft to search the
security logs as you can specify particular events and also text strings
such as user name or folder/file name. That can help you quickly find
relevant information. --- Steve


"Doug" <a@xxxxx> wrote in message
news:OXR6m$5lGHA.4052@xxxxxxxxxxxxxxxxxxxxxxx
Hello All:

I need to track access to a specific folder and also a particular users
movements around the network. Without running a sniffer fulltime, is
there anyway to accomplish this.

If I turn on auditing, I'm getting all events and I just need it for one
user and in particular, his/her access to specific folders.

thanks





.

Relevant Pages

  • Re: Autoexec.nt file missing?
    ... you can't enable Auditing on a computer running Home Edition. ... You must specify what to audit. ... >> example, a file, folder, registry key, printer, and so forth-that has its ...
    (microsoft.public.windowsxp.newusers)
  • Re: Autoexec.nt file missing?
    ... you can't enable Auditing on a computer running Home Edition. ... You must specify what to audit. ... example, a file, folder, registry key, printer, and so forth-that has its ...
    (microsoft.public.windowsxp.newusers)
  • Re: Netwatcher
    ... auditing of logon events for success and failure to see who is accessing or trying to ... and users group may have excessive permissions on the root/drive folder. ...
    (microsoft.public.win2000.security)
  • Re: Autoexec.nt file missing?
    ... you can't enable Auditing on a computer running Home Edition. ... You must specify what to audit. ... > example, a file, folder, registry key, printer, and so forth-that has its ...
    (microsoft.public.windowsxp.newusers)
  • RE: Folder Permissions Audit Utility
    ... Besides Pedro's suggestion, you can enabled Change Permission auditing, if ... double-click "Audit object access". ... locate the file or folder you want to audit. ... <Thread-Topic: Folder Permissions Audit Utility ...
    (microsoft.public.windows.server.sbs)