I want to audit logon events and object access (specific files) for success
and failure in my Workgroup. I am using Windows XP Pro (SP1) on the machines
and have 4 computers on an Ethernet. I want to know if and when unauthorized
persons are writing to these files. I have the audit policies in place,
rebooted, and then set up auditing on the folder with the files. I then
shared the folder and verified the shared folder and NTFS permissions. The
Security log shows plenty of “successes” but no “failures” when I try to
change the file over the network. It works with both “successes” and
“failures” when I log in as a user on the local machine and try to change the
file. What did I miss to make this work over the network?
|
Similar Threads
