Auditing info needed
Hi Vaibhav
Use file server resource manager and configure File screen audit...
In the console tree, right-click File Server Resource Manager, and then click
Configure options. The File Server Resource Manager Options dialog box opens.
On the File Screen Audit tab, select the Record file screening activity in the auditing database check box.
Click OK. All file screening activity will now be stored in the auditing database and can be viewed by running a File Screen Audit Report.
Microsoft TechNet Forum Bandara
January 15th, 2012 8:24pm
Hello all,
I have a folder on a windows server 2008 member server which needs to be audited. I opened local gpedit.msc >> expanded computer configuration >> expanded windows settings >> expanded security settings >> expanded advanced audit policy
configuration >> expanded system audit -- local group policies >>highlighted object access >>> enabled audit detailed file system ....... enabled audit file share .......... audit file system (for success and failure)
On the folder that needs to be audited >>> made a right click properties >>> security tab >>> advance >> auditing tab >>> edit >>> I have added the domain users and selected options ----
create files/write data
create folders/append data
write attributes
write extended attributes
delete subfolder and files
delete
I have not enabled the read option because many users access this folder and too many logs are created.
Below mentioned things I cannot track, please let me know how I can achieve this --
when I create a new file/folder, there is no new event in the event viewer.
when I rename a file it shows that the file is deleted but the new name is not listed.
Can you please let me know how I can achieve this?
Thank you all in advance.
Vaibhav
Free Windows Admin Tool Kit Click here and download it now
February 4th, 2012 11:43am
Hi Vaibhav
Use file server resource manager and configure File screen audit...
In the console tree, right-click File Server Resource Manager, and then click
Configure options. The File Server Resource Manager Options dialog box opens.
On the File Screen Audit tab, select the Record file screening activity in the auditing database check box.
Click OK. All file screening activity will now be stored in the auditing database and can be viewed by running a File Screen Audit Report.
Microsoft TechNet Forum Bandara
February 4th, 2012 12:27pm
Thanks Bandara for your reply .. I tried as you suggested but I am just not able to get the desired results ....
I googled up about the specific seps but no go ....
I did check the option as you said but where do go I next -- can you please guide me on this
Thanks
Free Windows Admin Tool Kit Click here and download it now
February 4th, 2012 7:57pm