Announcement

Collapse
No announcement yet.

Auditing my File Server

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Auditing my File Server

    Hi,

    today i tried to find who deleted some folder on our file server, and i could not find anything on the log, is my auditing correct? that is from default domain policy.

    audit.doc
    Thanks & Regards

    Retaliator

    MCSA/MCSE/CCNA
    Computer Science Graduate

  • #2
    Re: Auditing my File Server

    Originally posted by Retaliator View Post
    Hi,

    today i tried to find who deleted some folder on our file server, and i could not find anything on the log, is my auditing correct? that is from default domain policy.

    [ATTACH]2955[/ATTACH]
    You audit is set up correctly for 'auditing object access'. If anything, you have over configured and may lead to a lot of events that will hamper detecting a breach of a system.

    When auditing files and folders, you need to set the GPO as you have done so and then you need to go to the properties of the object (file and folder in your case), click on the Security Tab and then advanced.

    Click on the 'auditing tab' and then add the appropriate Groups or Users you want to audit. You may want to add the 'authenticated users' group or 'everyone'.

    Comment


    • #3
      Re: Auditing my File Server

      Hi there,
      sorry for the slight hijack, but i'm interested in doing the very same thing. We often get users saying "it wasn't me!" when asked if they deleted a file/folder.
      Would turning auditing on cause a performance hit on a network with up to 25 users on it at the same time?
      Thanks
      [/end hijack]

      Comment


      • #4
        Re: Auditing my File Server

        Originally posted by k.jacko View Post
        Hi there,
        sorry for the slight hijack, but i'm interested in doing the very same thing. We often get users saying "it wasn't me!" when asked if they deleted a file/folder.
        Would turning auditing on cause a performance hit on a network with up to 25 users on it at the same time?
        Thanks
        [/end hijack]
        You should be ok providing you don't go crazy with what is audited. It depends on the spec. of your server of course.

        Comment


        • #5
          Re: Auditing my File Server

          When adding domain users. will it audit an individual and tell you who deleted the file? Or do I need to list each and every user to be audited. As you may know, everyone is a domain user under a domain.

          Comment


          • #6
            Re: Auditing my File Server

            AFAIK it will list the user account. Test it and find out for yourslf and then roll it out as approprate from there. Let us know how you get on.

            Comment

            Working...
            X