Re: Audit files

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 07/11/05 

Date: Mon, 11 Jul 2005 11:42:26 -0500

The other posters did a great job explaining what to do but FYI auditing
every file for every permissions for every user will generate a tremendous
amount on object access events in the security log and I would suggest that
you increase it's size to at least 100MB. More than likely you will be
overwhelmed with such events and it will be difficult to find useful
information. Unless you are bound by regulations to do such you may want to
fine tune what folders/files you are auditing and only audit the bare number
of permissions needed to find the information that you need. You will find
Event Comb from Microsoft helpful in searching the security log for events
and text strings. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;308471 --- Event
Comb

"José Carretero García" <jose.carretero@edp-sl.com> wrote in message
news:%23xQpFtfhFHA.3164@TK2MSFTNGP15.phx.gbl...
> Hi to everyone,
>
> I need to audit any folders and files in a share drive. I want to know
> when every users of the domain delete, open, create a file or folder.
> My server is a w2003.
>
> Thank you
>
>

Relevant Pages

  • Re: Tracking permission changes.
    ... Turning on success auditing for object ... use the Advanced view in the NTFS permissions ... where you will see an Audit tab. ...
    (microsoft.public.security)
  • Re: AD auditing is giving too much info
    ... That is the nature of auditing object access. ... If you have to audit all ... for some permissions then you can reduce the number of events recorded. ...
    (microsoft.public.windows.server.security)
  • RE: Folder Permissions Audit Utility
    ... Besides Pedro's suggestion, you can enabled Change Permission auditing, if ... double-click "Audit object access". ... locate the file or folder you want to audit. ... <Thread-Topic: Folder Permissions Audit Utility ...
    (microsoft.public.windows.server.sbs)
  • Re: DC Policy: just want to audit files, not set security
    ... the particular directory to root the auditing ... different permissions within the area. ... >> I had never thought of using a SCE template File System ... >>> lot of events in the security log. ...
    (microsoft.public.windows.server.security)
  • Re: Error on password reset
    ... I will try your auditing suggestion today, I haven't tried that at all. ... users/change passwords with this new permission. ... I turned off inherit permissions on these two folders, ... > process and read the event details to see what events were used and which ...
    (microsoft.public.windows.server.active_directory)