• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 226
  • Last Modified:

Having trouble setting audit log for file access, changes and deletions in Windows Server 2003, SBS

I have set my Audit Objects on and have changed some files on the server, but still do not see these changes in the Event Viewer log.  I can see users logging in and out, but not file changes.  Am I looking in the right place?  I even added an audit in the folder I am most interested in and still see nothing.

I feel like I am missing a "switch" somewhere.

I have made setting changes in Domain Controller Policies and Domain Policies.  Could someone also tell me what the difference is in these two windows?

My concern is we have had entire folders disappear more than once and would like to see who may be doing this.

Thank you in advance for your help.
0
bunky9960
Asked:
bunky9960
1 Solution
 
placebo69aCommented:
Turning on Audit Object Access is not enough for events to start popping up in your security log. You have to apply the auditing policy to specfic files or folders in order to catch events concerning those files and folders. This can be done by following the instructions in this article.
Let me know if this helps. :)
0
 
bunky9960Author Commented:
Yes!  This worked great.  I can now track the file usage and see who is doing what they should not be doing.  Thanks again.
0

Featured Post

Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now