audit object access

[san]

Hi All,

I am in windows 2000 domain enviornment. I have shared two folders and
auditing is enable on that. I had even enable audit object access policy in
parent domain object. But then also I have not seen any event for accessing
shared folders. What and where is wrong?

Rgds
San

 

[Mike Shepperd]

Digging from old memories...

Once you've enabled audit object access and enabled auditing on the specific
folders you should be good. If it's not working, make sure that the policy
has been properly applied to the server. Run gpresult -v > gp.txt then
check for the proper settings to ensure that they've applied.

It seems like in Windows 2000 there was a problem with it working as
expected, but it's been so long that my memories are inaccessible and I
can't find any quick hits on the web...

--
Mike Shepperd
Sunfire Solutions LLC
Seattle, WA

[This posting is provided AS-IS, with no warranties and confers no rights]

 

[Holger Voges]

san hatte die Idee :

Hi All,

I am in windows 2000 domain enviornment. I have shared two folders and
auditing is enable on that. I had even enable audit object access policy in
parent domain object. But then also I have not seen any event for accessing
shared folders. What and where is wrong?

Rgds
San

In the mmc "local security settings" you can see, if auditing is
enabled.
Have you configured the SACL´s? (the Entries in the advanced Security
Tab on the files which specifiy, which actions and from whom have to be
audited?)

 

[Jorge de Almeida Pinto [MVP - DS]]

first you need to enable audit object access policy on the local GPO OR on a
AD GPO where the server being audited falls into the scope of management of
the GPO

besides that you need to define a SACL on the object to be audited which
defines the action, for whom, for success or failure in the audit

eventual results can be found in the seuciryt event log of the server that
hosts the objects being audited

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx