[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

audit object access - who deletes and creates folders on a mapped network drive

Posted on 2007-07-23
6
Medium Priority
?
567 Views
Last Modified: 2013-12-04
i have a small business server 2003 premium edition server.  the workstations are running windows xp pro. each workstation has a mapped drive to the G: drive which is where all work is stored.  i want to be able to find out who created folders on this drive and who deletes folders.  it has been know that sometimes a folder can get mistakenly deleted and i want to find out who it is.


0
Comment
Question by:brad2000smith
6 Comments
 
LVL 7

Expert Comment

by:pegasys
ID: 19549216
The only way to do this is to rightclick on the file. Click on the security tab (i.e. wher eyou set permissions and that) and then click on the advanced button to see who the current owner is.
0
 
LVL 63

Assisted Solution

by:SysExpert
SysExpert earned 960 total points
ID: 19549219
Turn on auditing in the MMC policies.

Then it will show up in the security event log.

I hope this helps !
0
 
LVL 32

Accepted Solution

by:
r-k earned 540 total points
ID: 19550615
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:brad2000smith
ID: 19554412
i have turned on auditing by doing the following - logged onto my server, start, progrmas, administrative tools, domain security policy, local policies, audit policy, enabled success and failure for object access.  i can now see object access events being logged under the security log in event viewer.  i created a folder on the mapped network drive G: and deleted the folder that i created.  i am logged onto my xp machine as smithb.  i cant seem to see any logs that smithb created a folder and deleted a folder.  what should i see or what should i be looking for? have i done this right?
0
 

Author Comment

by:brad2000smith
ID: 19554456
i think i now need to configure auditing on the g drive. so should i log on locally to the server and audit the local path which is D:\DATA\

right clcik the folder then security,advanced, auditing and add the everyone group in there or should i right clcik the map (g:) and do it that way? when i try and add the auditing to the g drive it says about removing all other audits but i dont have any other audits so im guessing this doesnt matter. could some one advise please.
0
 
LVL 63

Assisted Solution

by:SysExpert
SysExpert earned 960 total points
ID: 19556583
You should do it from the Local server where the share is located.

 
I hope this helps !
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Article by: btan
The intent is not to repeat what many has know about Ransomware but more to join its dots of what is it, who are the victims, why it exists, when and how we respond on infection. Lastly, sum up in a glance to share such information with more to help…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
this video summaries big data hadoop online training demo (http://onlineitguru.com/big-data-hadoop-online-training-placement.html) , and covers basics in big data hadoop .
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question