File access auditing

Discussion in 'Windows Server' started by Jordon, Jun 17, 2008.

  1. Jordon

    Jordon Guest

    Server 2000 SP4 running AD.

    I have read many posts about how to log file and folder
    access, but it doesn't seem to work. I've enabled auditing
    of object access in a group policy on the domain controller.
    I've changed the properties of the folder to be audited and
    added the groups to audit and what's to be audited.

    Nothing shows up in the security event viewer when files
    are accessed, changed, added or deleted.

    It's got to be something I've overlooked.

    Can anyone steer me in the right direction?
    Jordon, Jun 17, 2008
    1. Advertisements

  2. Hello Jordon

    Please describe what you have configured on which server, which policy and
    where the policy is linked to and on which machine you search for the event
    entries. Please in detail so that we can follow your thoughts.

    Best regards

    Meinolf Weber
    Meinolf Weber, Jun 17, 2008
    1. Advertisements

  3. Jordon

    Jordon Guest

    I configured the group policy on the domain controller under
    Windows Settings/Security Settings/Local Policies/Audit Policy/
    Audit object access (success and failure).

    Then I navigated to a folder on the file server (different
    computer, but part of the domain) and under Properties/
    Security/Advanced/Auditing I created a new policy to audit
    domain users for List Folder / Read Data, Create Folders /
    Append Data, Delete and Delete sub Folders and Files.

    When that didn't work I turned on object access auditing on
    the file server under the local policy and that seemed to do
    the trick.

    Why wouldn't a domain policy work? And what would it be for?
    Jordon, Jun 17, 2008
  4. Jordon

    Dave Austin Guest

    Same here, Jordan. Did exactly as you did, per MS tech bulletin instructions et. al, but it did not work either.

    Lots of replies here about this, huh?

    If you do come up with anything on it, please let me know. I'll reciprocate.

    - Dave
    Dave Austin, Sep 8, 2008
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.