Link to home
Start Free TrialLog in
Avatar of Bradley Smith
Bradley SmithFlag for United Kingdom of Great Britain and Northern Ireland

asked on

audit object access - who deletes and creates folders on a mapped network drive

i have a small business server 2003 premium edition server.  the workstations are running windows xp pro. each workstation has a mapped drive to the G: drive which is where all work is stored.  i want to be able to find out who created folders on this drive and who deletes folders.  it has been know that sometimes a folder can get mistakenly deleted and i want to find out who it is.


Avatar of Adrian Sluijters
Adrian Sluijters
Flag of United Kingdom of Great Britain and Northern Ireland image

The only way to do this is to rightclick on the file. Click on the security tab (i.e. wher eyou set permissions and that) and then click on the advanced button to see who the current owner is.
SOLUTION
Avatar of SysExpert
SysExpert
Flag of Israel image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Bradley Smith

ASKER

i have turned on auditing by doing the following - logged onto my server, start, progrmas, administrative tools, domain security policy, local policies, audit policy, enabled success and failure for object access.  i can now see object access events being logged under the security log in event viewer.  i created a folder on the mapped network drive G: and deleted the folder that i created.  i am logged onto my xp machine as smithb.  i cant seem to see any logs that smithb created a folder and deleted a folder.  what should i see or what should i be looking for? have i done this right?
i think i now need to configure auditing on the g drive. so should i log on locally to the server and audit the local path which is D:\DATA\

right clcik the folder then security,advanced, auditing and add the everyone group in there or should i right clcik the map (g:) and do it that way? when i try and add the auditing to the g drive it says about removing all other audits but i dont have any other audits so im guessing this doesnt matter. could some one advise please.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial