Solved

Server 2008 R2: Filtering out a specific event from being logged in the Security log?

Posted on 2016-10-19
6
81 Views
Last Modified: 2016-10-25
I enabled audit access on a file server by following the instructions here: https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/

It has worked very well. The only issue is that we have a file sync process running on the server which is constantly reading many files. The activity from this process is populating the logs extremely quickly to the point that it is generating several 300MB log files a day.
If just this one software was not included, the logs would not grow so quickly.

How can I configure it so WIndows will not log the events started from this one process?
0
Comment
Question by:SeeDk
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 55

Expert Comment

by:McKnife
ID: 41850660
You can setup auditing for certain user groups. Only audit groups that don't contain the account that you use for your sync process.
0
 

Author Comment

by:SeeDk
ID: 41851903
We have been using the domain admin account for the sync process. And it is one of the accounts we want to monitor given the level of access it has.
There is no way to filter by process or file name? The process is started by a batch file, can that file be filtered out from logging?
1
 
LVL 55

Expert Comment

by:McKnife
ID: 41851910
Wait, you use the domain admin for a simple sync? Don't. Use another account, think of the least privilege principle. Other accounts can be granted the permissions needed for this task easily.
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 

Author Comment

by:SeeDk
ID: 41851948
I guess it was the easiest way to set it up back when it was done.
It should be simple to change.
So after I create an account just for this process, where do I find the option to edit out this account?
0
 
LVL 55

Accepted Solution

by:
McKnife earned 500 total points
ID: 41852363
"edit out"? What do you mean? I cannot advise how to handle your (unknown) sync software.
The plan is to edit the audit policies so that not everyone is audited. So that new account you switch to for the sync should not be part of the groups that you audit. If at this time you audit the "everyone" group, this obviously needs to be changed.
0
 

Author Comment

by:SeeDk
ID: 41852418
Thanks, I get it now. Yeah, I only meant changing the group that is audited, nothing about the sync software.
 I have it set as "Everyone" so I need to change this.
0

Featured Post

Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

717 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question