Re: auditing question-notifications

• Previous message: Steven L Umbach: "Re: Windows 2003 Kerberos error Event ID #8"
• In reply to: Drew Halevy: "auditing question-notifications"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Tue, 22 Feb 2005 19:15:18 -0600

Of course make sure that permissions are correct on the folders so that only
authorized users can gain access keeping in mind that any administrator on
the computer will always be able to access any folder. You can set up folder
auditing but it is not user friendly. First you need to enable auditing of
object access the appropriate security policy such as Local Security Policy.
Then you can enable auditing on folders for various permissions for success
and failure. This will generate a LOT of events in the security log so be
sure to increase it's size substantially to say at least 15 MB. You will
then need to search for Event ID's 560 and 562 pairs timestamped the same to
find out who accessed a folder and for what permission. There is not a
native way to send security alerts etc. There are third party programs such
as the one from Languard that you can try for free. See the links below for
more details. Good luck! --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
http://support.microsoft.com/default.aspx?scid=KB;en-us;q248260 -- example
how to configure auditing.
http://www.gfi.com/lanselm/ --- S.E.L.M. third party tool.

"Drew Halevy" <NOdrewSPAM@elmtreerdPLEASE.com> wrote in message
news:%23EEkjvSGFHA.3664@TK2MSFTNGP15.phx.gbl...
>I mainly support Exchange 2000, but one of my side jobs in the school
>district where I work is supporting the Special Education Department. This
>is the issue I have before me. There is a director and assistant director
>of special education. They are going to share a folder called docs, and
>within docs will be subfolders (6), one for each special ed examiner. The
>examiners will drop the document in appropriate sub-folder. Only the
>director, assistant director and the teacher will access to each folder.
>What I want to do is set up auditing so that both the director and
>assistant director know when each folder has been accessed. Only one is
>required to view the documents in question, so I would like a notification
>to go to both. I know (it has been a while since I have done it) that
>auditing writes to the Event Viewer. Is there a way to set it up to notify
>both the director and assistant director? Do I need a third party package?
>Thanks in advance. -Drew
>

• Previous message: Steven L Umbach: "Re: Windows 2003 Kerberos error Event ID #8"
• In reply to: Drew Halevy: "auditing question-notifications"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]