Re: DC Policy: just want to audit files, not set security

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 03/17/05

  • Next message: Roger Abell: "Re: DC Policy: just want to audit files, not set security" 
    Date: Wed, 16 Mar 2005 23:21:23 -0700

    You may a slightly misread the poster.

    I had never thought of using a SCE template File System
    definition to deliver only Audit SACL to some storage
    area, but I immediately thought I saw what the poster
    was indicating. Hence, I tried it out, and in fact if the
    DACL part is left empty with only a SACL definition
    provided, then upon application the DACL on the target
    storage is changed. That is, any explicit ACEs set on
    the target are removed, and inheritance will be adjusted
    (or not) depending on the settings choosen in the template. 

    -- 
Roger
"Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
news:%23xDuJYpKFHA.2852@TK2MSFTNGP14.phx.gbl...
> They are separate. Be sure to limit auditing to just what is needed [
> write/delete maybe] as the security log will fill up very quickly if you
try
> to audit everything. Just enabling auditing of object access will generate
a
> lot of events in the security log. Be sure to increase the size of the
> security log quite a bit to at least 20 MB to start.  --- Steve
>
> http://support.microsoft.com/default.aspx?scid=kb;en-us;301640  --- how to
> configure auditing.
>
>
> <-> wrote in message news:uv4XrRmKFHA.3500@TK2MSFTNGP14.phx.gbl...
> > Hello,
> >
> > I am being tasked with setting up auditing on the Windows directory of
the
> > domain controllers via the Domain Controller Security Policy.  They
don't
> > want to touch permissions on it.  The thing is, the two seem linked
> > together.  If I leave the security permissions blank, on the security
> > field and just go to auditing, and select a group and what to audit,
will
> > I run the risk of removing all permissions to the Windows directory?
> >
>
>
  • Next message: Roger Abell: "Re: DC Policy: just want to audit files, not set security"

    Relevant Pages

    • Re: Auditing a User
      ... users on the computer unless you enable auditing of object access and then ... audit only for that user and only for exactly what you want to track. ... access events recorded in the security log which you will want to increase ... substantially from default if you enable folder/file auditing. ...
      (microsoft.public.win2000.general)
    • Re: Auditing a User
      ... users on the computer unless you enable auditing of object access and then ... audit only for that user and only for exactly what you want to track. ... access events recorded in the security log which you will want to increase ... substantially from default if you enable folder/file auditing. ...
      (microsoft.public.win2000.networking)
    • Re: Auditing a User
      ... users on the computer unless you enable auditing of object access and then ... audit only for that user and only for exactly what you want to track. ... access events recorded in the security log which you will want to increase ... substantially from default if you enable folder/file auditing. ...
      (microsoft.public.win2000.security)
    • Re: File Auditing
      ... The nature of auditing of object access is that there will be many seemingly ... but instead create a global group or local groups of users you want to audit. ... avoid auditing write or you will continue to large amounts in the security log. ...
      (microsoft.public.win2000.security)
    • Auditing on a member server
      ... We have auditing set at AD to audit certain failures and success events, ... at a local server we cant get the auditing to log to security log any ... Our audit policy allows the security log to get up to 16 meg and it is ...
      (microsoft.public.windows.server.security)