Windows 2008 File auditing~

I am trying to work on windows 2008 file auditing function. I turn on 'Delete' audit on that folder

When I try to delete G:\file.txt, it always get duplicated record in Security Eventlog like in the following:

A handle to an object was requested.

Subject:
 Security ID:  HK\123
 Account Name:  123
 Account Domain:  HK
 Logon ID:  0x60a40b

Object:
 Object Server:  Security
 Object Type:  File
 Object Name:  G:\file.txt
 Handle ID:  0xc04

Process Information:
 Process ID:  0x184c
 Process Name:  C:\Windows\explorer.exe

Access Request Information:
 Transaction ID:  {00000000-0000-0000-0000-000000000000}
 Accesses:  DELETE
   READ_CONTROL
   SYNCHRONIZE
   ReadAttributes
   
 Access Mask:  0x130080
 Privileges Used for Access Check: -
 Restricted SID Count: 0

how could this happened?

March 25th, 2015 12:16am

You can take a look at the below articles which provides auditing information.
http://support.microsoft.com/en-us/kb/2771404
https://technet.microsoft.com/en-us/magazine/2008.03.auditing.aspx

and you could try this  LepideAuditor for file server ( http://www.lepide.com/file-server-audit/ ) to audit of specific locations for compliance and allows to track who accessed a files/folders and know what happening in the file or folder and view access to specific files and folders. It generates report of the entire file servers from a centralized location and get instant alerts for critical changes.
Free Windows Admin Tool Kit Click here and download it now
March 25th, 2015 3:36am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics