Solved

Server 2008 R2: Filtering out a specific event from being logged in the Security log?

Posted on 2016-10-19
6
75 Views
Last Modified: 2016-10-25
I enabled audit access on a file server by following the instructions here: https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/

It has worked very well. The only issue is that we have a file sync process running on the server which is constantly reading many files. The activity from this process is populating the logs extremely quickly to the point that it is generating several 300MB log files a day.
If just this one software was not included, the logs would not grow so quickly.

How can I configure it so WIndows will not log the events started from this one process?
0
Comment
Question by:SeeDk
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 54

Expert Comment

by:McKnife
ID: 41850660
You can setup auditing for certain user groups. Only audit groups that don't contain the account that you use for your sync process.
0
 

Author Comment

by:SeeDk
ID: 41851903
We have been using the domain admin account for the sync process. And it is one of the accounts we want to monitor given the level of access it has.
There is no way to filter by process or file name? The process is started by a batch file, can that file be filtered out from logging?
1
 
LVL 54

Expert Comment

by:McKnife
ID: 41851910
Wait, you use the domain admin for a simple sync? Don't. Use another account, think of the least privilege principle. Other accounts can be granted the permissions needed for this task easily.
0
The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

 

Author Comment

by:SeeDk
ID: 41851948
I guess it was the easiest way to set it up back when it was done.
It should be simple to change.
So after I create an account just for this process, where do I find the option to edit out this account?
0
 
LVL 54

Accepted Solution

by:
McKnife earned 500 total points
ID: 41852363
"edit out"? What do you mean? I cannot advise how to handle your (unknown) sync software.
The plan is to edit the audit policies so that not everyone is audited. So that new account you switch to for the sync should not be part of the groups that you audit. If at this time you audit the "everyone" group, this obviously needs to be changed.
0
 

Author Comment

by:SeeDk
ID: 41852418
Thanks, I get it now. Yeah, I only meant changing the group that is audited, nothing about the sync software.
 I have it set as "Everyone" so I need to change this.
0

Featured Post

Free eBook: Backup on AWS

Everything you need to know about backup and disaster recovery with AWS, for FREE!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It’s the first day of March, the weather is starting to warm up and the excitement of the upcoming St. Patrick’s Day holiday can be felt throughout the world.
No single Antivirus application (despite claims by manufacturers) will catch or protect you from all Virus / Malware or Spyware threats. That doesn't stop you from further protecting yourself however - and this article is to show you how.
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question