Trace NTFS File/Folder Permissions Modification

Is there any way natively in 2000/2003 server to audit which user modified NTFS permissions on a folder? I don't think there is, but thought I'd ask as we've just had an e-mail go around at work that an unauthorised modification has been made to permissions on the root level of a server data drive.....
LVL 1
Stuart OramIT Technician - Project SitesAsked:
Who is Participating?
 
oBdAConnect With a Mentor Commented:
You can audit anything you can change for a file. Just don't get carried away and start to audit all events in a large folder from the top down, this will bring down the best of file servers (and fill the security event log pretty quickly) ...
How to set up and manage operation-based auditing for Windows Server 2003, Enterprise Edition
http://support.microsoft.com/kb/325898
You just can't do that retroactively; if auditing wasn't enabled during the change, then you can't find the culprit now.
0
 
Stuart OramIT Technician - Project SitesAuthor Commented:
Thanks - Haven't made in depth use of the security log so wasn't sure quite what events it was capable of logging!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.