Audit Specific Folders on Windows 2003 Server

Here are the facts:

I have a server that holds a ton of information that is accessed by 5000 employees
I want to audit object access on one folder, and one folder only

I have seen a lot of information on this subject and they all say the same thing:

Step One - Go to the group policy editor and turn on successful events for Audit Object Access
and
Step Two - Go to the folder I want to audit and add the group or users I want to audit,  then select the "actions" you want to audit

I have already learned that doing step two without step one produces zero results. HERE IS THE REAL QUESTION. If I do step one, but dont define a folder to audit, will it start filling up my security log with stuff, OR, Is step two required to get any results at all.

Thanks in advanve for your help.

phishyman2Asked:
Who is Participating?
 
Jay_Jay70Connect With a Mentor Commented:
step two is required...... you have to have both configured or nothing will work
0
 
zorba111Commented:
NO !!

If you do step 1 on its own, you get a whole load of access events by default for things you haven't even told the system you want to monitor !!

I  think that a lot of things like the registry and system folders log acces events as soon as a GPO enables a "Object Access Policy".
0
All Courses

From novice to tech pro — start learning today.