Auditing some shared folders

[Daniel Resende]

Hi everyone,

I need to auditing some shared folders in my W2K Server
and I don`t know exactly how do I do that.

What do I need to enable in gpedit.msc to start to
auditing the shared folder?

In the folders`s properties I already enable the auditing
in some itens to the folder.

The Server is just a file server and don`t have the AD
activated.

Thanks to any helps,

Daniel Resende
Suppport Analist

 

[Laura E. Hunter \(MVP\)]

Enabling auditing is a 2-step process. First, you enable object auditing in
group policy. Second, you turn on auditing for specific folders on your
server. This link will walk you through it step-by-step:

http://www.microsoft.com/windows200...00/en/professional/help/security_overview.htm

 

[Daniel Resende]

But how do I do to audit an event just like when an user
deleted a file or folder from a shared access?

Best Regards,

Daniel

 

[Steven L Umbach]

The following link may also be helpful. You will need to filter the security
log and look for paired events 560/562. The information will be there, but
you have to sift through it and be sure to increase the size of your
security log substantialy. I suggest try to avoid using the everyone group
for auditing and audit bare number of permissions needed to accomplish your
task instead of full. --- Steve

http://www.microsoft.com/technet/security/guidance/secmod144.mspx