Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Set up Auditing of file level access on a server

Posted on 2010-08-24
6
Medium Priority
?
507 Views
Last Modified: 2012-05-10
Hi

We are running Windows 2003 SP2 DC's. We also have a Windows 2003 SP2 server....

People are randomly complaining that files are going missing from here, so I would like to silently turn on auditing of who is reading and deleting these files.

Do I have to change the Default Domain Policy to carry this out (or any other GPO), or can this be carried out on the server itself?

Thanks in advance!
0
Comment
Question by:kam_uk
  • 3
  • 3
6 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 2000 total points
ID: 33513635
You can set it on a GPO at the OU level where that server is and use security filtering to only apply to that box or even a local GPO (I would not do it on the default domain policy)
You need to configure auditing in two places

1.  Configure "audit object access"  domain or OU  linked Group Policy that applies to that server or on the server's local GPO:
Computer Configuration | Windows Settings | Security Settings | Local Policies | Audit Policies. Enable success/failure auditing for "Audit object access."

2.  Configure an audit entry on the specific folder(s) that you wish to audit. Right-click on the folder--Properties | Advanced. From the Auditing tab, click Add, then enter the users/groups whom you wish to audit and what you want to audit - auditing Full Control will create an audit entry every time anyone opens/changes/closes/deletes a file.
...and another question I helped with  http://www.experts-exchange.com/Software/Server_Software/File_Servers/Q_24637392.html


Thanks

Mike
0
 
LVL 3

Author Comment

by:kam_uk
ID: 33514631
Hi Mike

Thanks for the great advise!

Couple of questions:

1. This is on a partner site so I don't have access to their DC's/GPO's (although I can request work to be carried out). So I went to Admin Tools > Local Security Settings on the server and "Audit Object Access" already had a tick for Success/Failure. Assume there's nothing else I need to do then?

2. I want to Audit everything for everyone on that folder :) So I guess I need to add FULL CONTROL for EVERYONE? Would this about cover it?

3. Assuming I do this, where are these logs actually located?
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 33514710
Yeah that should be enough,  they will be in the security event logs;  monitor the logs because you are going to have a lot of events (not sure if you all are archiving or overwriting logs)

Another good link on this is here:   http://technet.microsoft.com/en-us/library/cc784387(WS.10).aspx

thanks

Mike
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
LVL 3

Author Comment

by:kam_uk
ID: 33514804
Thanks.

One question though - it's possible for someone to delete an entry/entries in the Event Log isn't it? Is there anyway to prevent this?

I heard that SCOM may have a feature that "grabs" Audit Logs as they are written, so that they are held apart from the server where other admins don't have access?
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 33514866
If they deleted/cleared entries in the log you will see that event logged....at that point you and your supervisor need to ask the person why they are deleting security event log entries.

Check with the admins on that end to see if the logs are being grabbed.  

Thanks

Mike
0
 
LVL 3

Author Comment

by:kam_uk
ID: 33515175
Ah ok - so you can set up auditing to for someone deleting security logs? DO I need to do anything to enable this or is it default?
0

Featured Post

Transaction-level recovery for Oracle database

Veeam Explore for Oracle delivers low RTOs and RPOs with agentless transaction log backup and transaction-level recovery of Oracle databases. You can restore the database to a precise point in time, even to a specific transaction.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
The article explains the process to deploy a Self-Service password reset portal I developed a few years ago. Hopefully, it will prove useful to someone.  Any comments, bug reports etc. are welcome...
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question