Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

audit forMS 2008 server R2

Posted on 2013-06-02
3
Medium Priority
?
366 Views
Last Modified: 2013-06-12
I wanted to know what auditing is available for MS server 2008 R2?  Lately, we've had issues with someone in our  team owning up to modifying share and ntfs permissions on a particular server and/or folders and we wanted to audit these changes.  What's available within the MS world for this challenge?  Lastly, what if we go outside MS world?
0
Comment
Question by:uppercut7141
3 Comments
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39215454
Unless you already have enabled any of the items found in the Local Security Policy, only the default items will be logged. Those logs are found in the security log of the event viewer.

You can open the options for Audit Policy and enable the options. After enabling them, you should see more logging occur as events happen.
0
 
LVL 5

Accepted Solution

by:
MisterTwelve earned 2000 total points
ID: 39215751
Hi

Another options is SCOM and ACS. if you have SCOM in your domain is the best options, because you have reports to get information you need. Read security logs is not easy, but without SCOM is only option i know.

Take a look on this http://blogs.technet.com/b/fesiro/archive/2013/01/08/how-to-deploy-audit-collection-services-acs-in-scom-2012.aspx

Regards
0
 

Author Comment

by:uppercut7141
ID: 39219071
I'm trying to Click Start, point to Administrative Tools, and then Group Policy Management; however, there is no GROUP POLICY MANAGEMENT option when I attempt to do this on a Server 2008 R2 server.  Do I need to do something else for this option to appear?  

I just want to be able to track who modified changes on either NTFS or folder permission on a specific time.  When I attempted to go on the event log, everything is taken up...meaning all logs seem to be from today.  I can't view anything from 3 or 4 days ago which is where I'd like to begin the audit.
0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Finding a job can be stressful - searches, resume tweaks, and networking events can be super boring. Luckily we're here to help you land your dream job!
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Suggested Courses

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question