Solved

Having trouble setting audit log for file access, changes and deletions in Windows Server 2003, SBS

Posted on 2008-10-09
2
217 Views
Last Modified: 2013-12-04
I have set my Audit Objects on and have changed some files on the server, but still do not see these changes in the Event Viewer log.  I can see users logging in and out, but not file changes.  Am I looking in the right place?  I even added an audit in the folder I am most interested in and still see nothing.

I feel like I am missing a "switch" somewhere.

I have made setting changes in Domain Controller Policies and Domain Policies.  Could someone also tell me what the difference is in these two windows?

My concern is we have had entire folders disappear more than once and would like to see who may be doing this.

Thank you in advance for your help.
0
Comment
Question by:bunky9960
2 Comments
 
LVL 4

Accepted Solution

by:
placebo69a earned 500 total points
ID: 22682541
Turning on Audit Object Access is not enough for events to start popping up in your security log. You have to apply the auditing policy to specfic files or folders in order to catch events concerning those files and folders. This can be done by following the instructions in this article.
Let me know if this helps. :)
0
 

Author Closing Comment

by:bunky9960
ID: 31504689
Yes!  This worked great.  I can now track the file usage and see who is doing what they should not be doing.  Thanks again.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
OfficeMate Freezes on login or does not load after login credentials are input.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

713 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question