Audit object access

[Guest]

Hello !

I have a problem with auditing.

Auditing is set on some folder and generally it's working
but as I enable auditing for deleting files and folders only
auditing works also on all kind of other access not only deleting.

for example when I create a file within audited folder
this kind of access is also audited (put into the logs)
Is it possible to do it this way that only deleting folders or files will be
put into logs ?

Thank You

 

[Steven L Umbach]

I am afraid not. When you enable auditing of object access you will also see
what may seem to be many unrelated events recorded in the security log but
that is normal. What you may find helpful is to use Event Comb which is
available at the link below. You can for instance use it to search for only
security events with the word "delete" in them which will greatly narrow the
search for you.--- Steve

http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en