Trace NTFS File/Folder Permissions Modification

Posted on 2009-02-10
Last Modified: 2013-12-05
Is there any way natively in 2000/2003 server to audit which user modified NTFS permissions on a folder? I don't think there is, but thought I'd ask as we've just had an e-mail go around at work that an unauthorised modification has been made to permissions on the root level of a server data drive.....
Question by:Stuart Oram
    LVL 82

    Accepted Solution

    You can audit anything you can change for a file. Just don't get carried away and start to audit all events in a large folder from the top down, this will bring down the best of file servers (and fill the security event log pretty quickly) ...
    How to set up and manage operation-based auditing for Windows Server 2003, Enterprise Edition
    You just can't do that retroactively; if auditing wasn't enabled during the change, then you can't find the culprit now.
    LVL 1

    Author Closing Comment

    by:Stuart Oram
    Thanks - Haven't made in depth use of the security log so wasn't sure quite what events it was capable of logging!

    Featured Post

    Do You Know the 4 Main Threat Actor Types?

    Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

    Join & Write a Comment

    Problem Description: Actually I found the below issue with some customers after migration from SMS 2003 to SCCM 2007 and epically if they change site code, some clients may appear in the console with old site code, plus old sites still appearing …
    Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now