SeeDk
asked on
Server 2008 R2: Filtering out a specific event from being logged in the Security log?
I enabled audit access on a file server by following the instructions here: https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/
It has worked very well. The only issue is that we have a file sync process running on the server which is constantly reading many files. The activity from this process is populating the logs extremely quickly to the point that it is generating several 300MB log files a day.
If just this one software was not included, the logs would not grow so quickly.
How can I configure it so WIndows will not log the events started from this one process?
It has worked very well. The only issue is that we have a file sync process running on the server which is constantly reading many files. The activity from this process is populating the logs extremely quickly to the point that it is generating several 300MB log files a day.
If just this one software was not included, the logs would not grow so quickly.
How can I configure it so WIndows will not log the events started from this one process?
McKnife
You can setup auditing for certain user groups. Only audit groups that don't contain the account that you use for your sync process.
ASKER
We have been using the domain admin account for the sync process. And it is one of the accounts we want to monitor given the level of access it has.
There is no way to filter by process or file name? The process is started by a batch file, can that file be filtered out from logging?
There is no way to filter by process or file name? The process is started by a batch file, can that file be filtered out from logging?
Wait, you use the domain admin for a simple sync? Don't. Use another account, think of the least privilege principle. Other accounts can be granted the permissions needed for this task easily.
ASKER
I guess it was the easiest way to set it up back when it was done.
It should be simple to change.
So after I create an account just for this process, where do I find the option to edit out this account?
It should be simple to change.
So after I create an account just for this process, where do I find the option to edit out this account?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks, I get it now. Yeah, I only meant changing the group that is audited, nothing about the sync software.
I have it set as "Everyone" so I need to change this.
I have it set as "Everyone" so I need to change this.