Re: All I want to do is audit "delete" events, but log gets massive: how to do effiecntly?

From: S. Pidgorny (slavickp_at_yahoo.com)
Date: 11/03/05 

Date: Thu, 3 Nov 2005 20:44:30 +1100

Audit changes of the folders and not of the folders' contents? 

-- 
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-
"roga" <{news2005}REMOVE_THIS_UPPERCASE_2_REPLY@roga.co.uk> wrote in message 
news:%23tRJzTF4FHA.3876@TK2MSFTNGP09.phx.gbl...
>I am trying to audit "deletes" only on a shared folder (and subfolders) for 
>domain users
>
> However the security log fills with masses of irrelevant entries, and gets 
> so large it messes up vss backup! and after 4 days it reaches its size 
> limit
>
> How can I efficiently audit users deleting files and folders?
>
> regards
>
> Roga
>
>
>

Relevant Pages

  • Re: Event Log show Folder or File Object Acccess
    ... I though you had already enabled auditing on folders you wanted to ... Be sure to audit the bare amount of permissions necessary to ... >> Event Source: Security ... >>> On the Domain Security Logs and Domain Controller Security Logs for the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Win2k file share monitor
    ... Just enable auditing on the folders that you have shared. ... Then select the folders you want to audit and what specific ... specified access will be logged to the security log in the event viewer. ...
    (Security-Basics)
  • RE: audit user activity
    ... you can enable Audit log in Event log on SBS: ... double-click "Audit object access". ... To audit successful access of specified files, folders, select the ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Folder Security
    ... First, yes, you can audit. ... folders (use edit to select This folder and subfolders) by Everyone. ... you could use different NTFS permissions so that non-admin ...
    (microsoft.public.windows.server.security)
  • Re: Auditing object access from network
    ... >Group Policy snap-in to enable the Audit Object Access setting in the Audit ... >auditing for files and folders, and no files or folders will be audited. ... Clearly, since I get audit log entries, I have already done as you suggest. ...
    (microsoft.public.win2000.security)
Quantcast