NTFS auditing - how to disable recording the creation of alternate data streams?
Hi experts.
I guess this is a tough one:
I have enabled auditing on a folder and let windows record write access to it ("create files/write data").
When I insert "ordinary" files, this works well and 1 file creates 1 eventlog entry - nice.
But If I copy files into it that have alternate data streams, I get 2 eventlog entries, which is very unpleasant, because I use eventlog task-triggering.
Can we tell windows somehow not to create separate event entries for alternate data streams?
--
Example log entry (on windows 8.1):
Object Name: \Device\HarddiskVolume8\au
I guess this is a tough one:
I have enabled auditing on a folder and let windows record write access to it ("create files/write data").
When I insert "ordinary" files, this works well and 1 file creates 1 eventlog entry - nice.
But If I copy files into it that have alternate data streams, I get 2 eventlog entries, which is very unpleasant, because I use eventlog task-triggering.
Can we tell windows somehow not to create separate event entries for alternate data streams?
--
Example log entry (on windows 8.1):
Object Name: \Device\HarddiskVolume8\au
or skip processing if the file name contains ":Zone"
ASKER
Hi.
I have asked this in another forum and got solutions.
Anyway, I'd like to know, Coralon, how would I "configure eventlog triggering to ignore multiple events that are very close together"
And David, how would I skip this? Auditing is not configurable.
I have asked this in another forum and got solutions.
Anyway, I'd like to know, Coralon, how would I "configure eventlog triggering to ignore multiple events that are very close together"
And David, how would I skip this? Auditing is not configurable.
if (filename like "*:Zone") return; //do nothing
else process file
else process file
ASKER
I have setup auditing, auditing writes event, those events trigger a script. So removing/excluding needs to be done at the start of that chain and there is no script to do that. Please note, that this .zone.identifier file is not even visible to explorer, nor to scripts, because it is no file but a stream of another file.
The solution is to use another folder and use eventtriggering again to start this:
Edit: @Coralon: I could edit the task so that it won't start again when already running, yes. But unfortunately, I have more than one task that gets triggered, so I would need a way to tell task B: "don't start if task A is already running" which is possible, too, but produces other unwanted effects. So I'll close this and use what I found myself. Thanks!
The solution is to use another folder and use eventtriggering again to start this:
remove-item 'c:\folder\*.*' -Stream Zone.IdentifierEdit: @Coralon: I could edit the task so that it won't start again when already running, yes. But unfortunately, I have more than one task that gets triggered, so I would need a way to tell task B: "don't start if task A is already running" which is possible, too, but produces other unwanted effects. So I'll close this and use what I found myself. Thanks!
ASKER
I've requested that this question be closed as follows:
Accepted answer: 0 points for McKnife's comment #a41017607
for the following reason:
self-solved
Accepted answer: 0 points for McKnife's comment #a41017607
for the following reason:
self-solved
please share your solution
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
You weren't talking about removing the streams.. you were talking about preventing their creation and dealing with the duplicate events.
Had you been talking about just removing the streams, I'd have recommended using sysinternals streams.exe to delete the extra streams. But, the powershell stuff obviously works.
Coralon
Had you been talking about just removing the streams, I'd have recommended using sysinternals streams.exe to delete the extra streams. But, the powershell stuff obviously works.
Coralon
ASKER
self-solved
You might have an easier time configuring your eventlog triggering to ignore mulitple events that are very close together (i.e. less than 1/2 second etc.)
Coralon