[Question] Audit Share

[Alan Tang]

Hello:

Is it possible to audit the Share. I want to audit which use have
perform the Share the folder or remove the share!

Thanks!

 

[Steven L Umbach]

You can enable auditing of object access and then enable auditing of folders/files,
however a lot of events will be generated in the security log. It takes a while to
learn how to track down pertinent events. I suggest that you try a test share first
and then view the security log to see how it works. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
http://support.microsoft.com/default.aspx?scid=kb;en-us;300549

 

[Alan Tang]

Hello:

I have try to enable but I can't identify which event is cause by the
share!

Does any solotion?

Thanks!

 

[Steven L Umbach]

You can't audit a share per se, but the folder that is shared. Events 560
and 562 should be generated for that folder when audited access occurs.
Tracking use of audited folders and files is cumbersome, but the information
is there if you dig deep enough. --- Steve