Re: Tracking access to folder

Enabling auditing of object access will generate a lot of seemingly
unrelated events but that just goes with the territory. When configuring
auditing for a folder be sure just to specify the users or a group
containing the users you want to track instead of users or everyone. Then
audit only the permissions you want to track instead of every permission and
the type of permission whether it be success or failure. List and read
permissions will generate a lot of object access events for success. What
can really help is to use the free Event Comb from Microsoft to search the
security logs as you can specify particular events and also text strings
such as user name or folder/file name. That can help you quickly find
relevant information. --- Steve


"Doug" <a@xxxxx> wrote in message
news:OXR6m$5lGHA.4052@xxxxxxxxxxxxxxxxxxxxxxx
Hello All:

I need to track access to a specific folder and also a particular users
movements around the network. Without running a sniffer fulltime, is there
anyway to accomplish this.

If I turn on auditing, I'm getting all events and I just need it for one
user and in particular, his/her access to specific folders.

thanks



.

Relevant Pages

  • Re: Netwatcher
    ... auditing of logon events for success and failure to see who is accessing or trying to ... and users group may have excessive permissions on the root/drive folder. ...
    (microsoft.public.win2000.security)
  • Re: Folder reappeares on desktop
    ... Enabling auditing of object access generates a lot of system events such as those ... I would be looking for an Event ID 560 for the parent folder where the ... security log when that happens but it is worth a try. ...
    (microsoft.public.win2000.security)
  • Re: Auditing / Event Log Entries...
    ... You would have to first enable auditing of object access on computer ... whatever permissions you wanted to audit for the user Mary Jane [assuming ... > Do you have to enable the Auditing on that specifi folder on the remote ...
    (microsoft.public.win2000.security)
  • RE: Folder Permissions Audit Utility
    ... Besides Pedro's suggestion, you can enabled Change Permission auditing, if ... double-click "Audit object access". ... locate the file or folder you want to audit. ... <Thread-Topic: Folder Permissions Audit Utility ...
    (microsoft.public.windows.server.sbs)
  • AD auditing is giving too much info
    ... a specific folder and all subfolders. ... testing purposes I've temporarily configured auditing as follows: ... Object Access Success/Failure (all other auditing has been ... I have double checked the file auditing properties for C:\Program ...
    (microsoft.public.windows.server.security)