Solved

audit forMS 2008 server R2

Posted on 2013-06-02
3
355 Views
Last Modified: 2013-06-12
I wanted to know what auditing is available for MS server 2008 R2?  Lately, we've had issues with someone in our  team owning up to modifying share and ntfs permissions on a particular server and/or folders and we wanted to audit these changes.  What's available within the MS world for this challenge?  Lastly, what if we go outside MS world?
0
Comment
Question by:uppercut7141
3 Comments
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39215454
Unless you already have enabled any of the items found in the Local Security Policy, only the default items will be logged. Those logs are found in the security log of the event viewer.

You can open the options for Audit Policy and enable the options. After enabling them, you should see more logging occur as events happen.
0
 
LVL 5

Accepted Solution

by:
MisterTwelve earned 500 total points
ID: 39215751
Hi

Another options is SCOM and ACS. if you have SCOM in your domain is the best options, because you have reports to get information you need. Read security logs is not easy, but without SCOM is only option i know.

Take a look on this http://blogs.technet.com/b/fesiro/archive/2013/01/08/how-to-deploy-audit-collection-services-acs-in-scom-2012.aspx

Regards
0
 

Author Comment

by:uppercut7141
ID: 39219071
I'm trying to Click Start, point to Administrative Tools, and then Group Policy Management; however, there is no GROUP POLICY MANAGEMENT option when I attempt to do this on a Server 2008 R2 server.  Do I need to do something else for this option to appear?  

I just want to be able to track who modified changes on either NTFS or folder permission on a specific time.  When I attempted to go on the event log, everything is taken up...meaning all logs seem to be from today.  I can't view anything from 3 or 4 days ago which is where I'd like to begin the audit.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Issue: One Windows 2008 R2 64bit server on the network unable to connect to a buffalo Device (Linkstation) with firmware version 1.56. There are a total of four servers on the network this being one of them. Troubleshooting Steps: Connect via h…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question