Solved

Server 2008 R2: Filtering out a specific event from being logged in the Security log?

Posted on 2016-10-19
6
77 Views
Last Modified: 2016-10-25
I enabled audit access on a file server by following the instructions here: https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/

It has worked very well. The only issue is that we have a file sync process running on the server which is constantly reading many files. The activity from this process is populating the logs extremely quickly to the point that it is generating several 300MB log files a day.
If just this one software was not included, the logs would not grow so quickly.

How can I configure it so WIndows will not log the events started from this one process?
0
Comment
Question by:SeeDk
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 54

Expert Comment

by:McKnife
ID: 41850660
You can setup auditing for certain user groups. Only audit groups that don't contain the account that you use for your sync process.
0
 

Author Comment

by:SeeDk
ID: 41851903
We have been using the domain admin account for the sync process. And it is one of the accounts we want to monitor given the level of access it has.
There is no way to filter by process or file name? The process is started by a batch file, can that file be filtered out from logging?
1
 
LVL 54

Expert Comment

by:McKnife
ID: 41851910
Wait, you use the domain admin for a simple sync? Don't. Use another account, think of the least privilege principle. Other accounts can be granted the permissions needed for this task easily.
0
NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

 

Author Comment

by:SeeDk
ID: 41851948
I guess it was the easiest way to set it up back when it was done.
It should be simple to change.
So after I create an account just for this process, where do I find the option to edit out this account?
0
 
LVL 54

Accepted Solution

by:
McKnife earned 500 total points
ID: 41852363
"edit out"? What do you mean? I cannot advise how to handle your (unknown) sync software.
The plan is to edit the audit policies so that not everyone is audited. So that new account you switch to for the sync should not be part of the groups that you audit. If at this time you audit the "everyone" group, this obviously needs to be changed.
0
 

Author Comment

by:SeeDk
ID: 41852418
Thanks, I get it now. Yeah, I only meant changing the group that is audited, nothing about the sync software.
 I have it set as "Everyone" so I need to change this.
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Many old projects have bad code, but the budget doesn't exist to rewrite the codebase. You can update this code to be safer by introducing contemporary input validation, sanitation, and safer database queries.
Do you know what to look for when considering cloud computing? Should you hire someone or try to do it yourself? I'll be covering these questions and looking at the best options for you and your business.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question