Viewing audit information in XP - nothing appearing in the event viewer

  • Thread starter Thread starter Darren
  • Start date Start date
D

Darren

I have enabled auditing on a folder and its files and subfolders for
my user name and for SYSTEM. I believe I have set this up correctly
and I have enabled audit for all access for success and failure.
However when I go into event viewer I cannot see any new messages
about what's happened. I have opened a file within the folder and
saved it and still don't see any new messages. Is there something that
I need to do to activate it or perhaps I've set it up wrong. Any help
will be much appreciated.

Thanks,
Darren.
 
Explain how exactly did you "enable auditing on a folder and its files".
If we knew exactly how you did it step-by-step, we could better determine
what went wrong.

I have enabled auditing on a folder and its files and subfolders for
my user name and for SYSTEM. I believe I have set this up correctly
and I have enabled audit for all access for success and failure.
However when I go into event viewer I cannot see any new messages
about what's happened. I have opened a file within the folder and
saved it and still don't see any new messages. Is there something that
I need to do to activate it or perhaps I've set it up wrong. Any help
will be much appreciated.

Thanks,
Darren.
 
JW said:
Explain how exactly did you "enable auditing on a folder and its files".
If we knew exactly how you did it step-by-step, we could better determine
what went wrong.
Click to expand...

OK.
1. In Windows explorer right click on the folder that I want to audit
and select Properties.
2. Select Security tab.
3. Click Advanced button.
4. Select Auditing tab.
5. Click Add button.
6. Entered WINXPOFFICE\Darren as the object name and clicked 'check
name' button and then clicked OK.
7. Ticked the full control for Successful & Failed so that all
checkboxes are ticked.
8. Clicked OK button.
9. Repeated steps 5-8 and entered SYSTEM as the object name.
10. Clicked 'replace auditing entries on all child objects with
entries shown here that apply to child objects' checkbox.
11. Clicked OK.
12. Clicked OK to leave the properties.

Did I miss anything when trying to set up auditing on my files and
folders?

Thanks,
Darren.
 
An exact step-by-step explanation is all we needed to find the problem.
You completed Part 1 just fine. Now it's time to complete Part 2.

Now go run Local Security Policy (under Admin Tools in Control Panel).
In the left pane, click on Audit Policy.
In the right pane, change "No Auditing" to the value you want (Success
and/or Failure).

You have to be logged into an account in the Administrator's group to do
this.

JW said:
Explain how exactly did you "enable auditing on a folder and its files".
If we knew exactly how you did it step-by-step, we could better determine
what went wrong.
Click to expand...

OK.
1. In Windows explorer right click on the folder that I want to audit
and select Properties.
2. Select Security tab.
3. Click Advanced button.
4. Select Auditing tab.
5. Click Add button.
6. Entered WINXPOFFICE\Darren as the object name and clicked 'check
name' button and then clicked OK.
7. Ticked the full control for Successful & Failed so that all
checkboxes are ticked.
8. Clicked OK button.
9. Repeated steps 5-8 and entered SYSTEM as the object name.
10. Clicked 'replace auditing entries on all child objects with
entries shown here that apply to child objects' checkbox.
11. Clicked OK.
12. Clicked OK to leave the properties.

Did I miss anything when trying to set up auditing on my files and
folders?

Thanks,
Darren.
 
Back
Top