Solved

ntfs folder permissions auditing

Posted on 2013-12-13
1
522 Views
Last Modified: 2014-01-27
how can i use folder auditing to see if someone was to add themselves rights to a folder that i only have permissions too? .
0
Comment
Question by:mrbayIt
1 Comment
 
LVL 6

Accepted Solution

by:
Tomislavj earned 500 total points
ID: 39717780
In the local policy (or GPO) of the computer, enable Success audits via one of the following:

1. Computer Configuration | Policies | Windows Settings | Security Settings | Local Policies | Audit Policy | Audit Object Access

2. Computer Configuration | Policies | Windows Settings | Security Settings | Advanced Audit Policy Configuration | Audit Policies | Object Access | Audit File System

Enable auditing on your directory by right-clicking on the directory in Windows Explorer and selecting Properties/Security/Advanced/Auditing/Edit/Add/Next.
Enter Everyone as the security principal to audit.
Check the "Successful" box for "Change permissions".

In the Security event log keep eye on event 4663 or 4670
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

I was supporting a handful of Windows 2008 (non-R2) 2 node clusters with shared quorum disks. Some had SQL 2008 installed and some were just a vendor application that we supported. For the purposes of this article it doesn’t really matter which so w…
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now