Re: Monitor Access To A Particular Share

From: Roger Abell [MVP] (mvpNoSpam_at_asu.edu)
Date: 09/02/05

  • Next message: Ant_IT_tEAM_eDUCATION_UK: "Deny Network access via a Policy - Help!!!" 
    Date: Thu, 1 Sep 2005 19:47:47 -0700

    When you enabled auditing on the underlying storage, you both set
    SACL on the storage and changed (directly or via GPO) the local
    security policy Auditing setting so that Success and Failure are
    enabled for Audit object access ? You must do both. 

    -- 
Roger
<matthewpomar@gmail.com> wrote in message 
news:1125588337.544756.81680@g14g2000cwa.googlegroups.com...
>I would like to know who is accessing a server share. For example, I
> have a Windows 2000 Server and a share called Public. When someone
> successfully reads or writes to this share, I would like to log the
> person who accessed it.
>
> I thought enabling auditing of success events on the server would do
> the trick, but it did not.
>
> I would appreciate any suggestions for techniques, scripts, or
> commercial products.
>
> Regards,
> Matthew
>
  • Next message: Ant_IT_tEAM_eDUCATION_UK: "Deny Network access via a Policy - Help!!!"

    Relevant Pages

    • Re: Auditing object access from network
      ... server with domain member clients accessing the target file structure via ... I want to audit file deletions in specific directories of a file server, ... NOT BY USERS ACCESSING FILES VIA THE NETWORK. ... Set up auditing ACLs for every entity in Active Directory, ...
      (microsoft.public.win2000.security)
    • RE: filenames changing
      ... Mal is right, let's turn on file auditing, and troll the security log ... the server resides, right-click on it and click Properties. ... On the Group Policy tab, select a GPO and click Edit (if there's no GPO ... Microsoft CSS Online Newsgroup Support ...
      (microsoft.public.windows.server.sbs)
    • SBS2K Server, how to change local policy, auditing on. Make Effective Setting.
      ... I ran Microsoft's MBSA 1.2.1 and noticed that auditing was not on on one ... I turned auditing on for the domain on the server, ... Effective Setting set is "Audit Account Management." ... Was I supposed to instead of editing the default domain policy in Active ...
      (microsoft.public.backoffice.smallbiz2000)
    • Re: URLSCAN.INI 0 Bytes in length
      ... I have turned on auditing now for that file. ... There are 10 websites running on this server. ... and am going to apply SP4 and see if I have any problems on it. ... > I'd suggest you check the event viewer and IIS logfiles. ...
      (microsoft.public.inetserver.iis.security)
    • Re: Event ID 538/540/576 fills up Security Log!!
      ... Maybe you don't have auditing for "privilige use" enabled on ... > I wonder why would this happen and if it's really related to backup jobs. ... > Could it be just issues of Exchange Server 2000?? ...
      (microsoft.public.win2000.security)
    • Quantcast