Solved

Windows 2003 Audit polidy success/failure audits - so many logs! need to cut down.

Posted on 2009-05-02
5
462 Views
Last Modified: 2012-05-06
I have enabled audit logs on a folder, and tested it out.

I added "domain users" as the group to audit thinking that this would include everyone in the domain.

Well when I open the folder being audited it creates 8 logs in the security folder. This just seems like a ton of logs for me for a simple action such as "open" a folder. What do you guys think? Is there a better way to do this, or is this a normal thing?

Thank you.
0
Comment
Question by:jaesoul
5 Comments
 
LVL 17

Expert Comment

by:Nik
ID: 24288745
I had the same need in the past and couldn't google for anything than for some third party tools like:
http://www.quest.com/spotlight-on-active-directory-pack/
http://www.manageengine.com/products/ad-manager/windows-active-directory-reports.html


0
 
LVL 5

Accepted Solution

by:
karstieman earned 500 total points
ID: 24288805
User the FILTER option in the Eventviewer option to find what you were looking for.
Otherwise, specify the audit more specifically and for instace audit only FAILED object access to this folder.
0
 

Author Comment

by:jaesoul
ID: 24290548
Hey Guys,

I am going to give these options a shot and get right back.Thank you.
0
 
LVL 6

Expert Comment

by:astralcomputing
ID: 24848463
Ok here is a really easy solution I like to use. In the logon script add the following line

echo %date%, %time%, %computername%, %username%, Sign on >> \\server\networkshare\login.log

This keeps a running tally of all logins, in a CSV format which can be imported into excel and sort, searched, etc...

You have the date, time, computer and username.
0

Featured Post

Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

Join & Write a Comment

This story has been written with permission from the scammed victim, a valued client of mine – identity protected by request.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now