Announcement

Collapse
No announcement yet.

Quota filling up 'Security' event log

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Quota filling up 'Security' event log

    Hi All,

    Please help me if you can.
    I have "File Server Management" installed on Windows server 2003 to do software-type Quota's on different directories within the same Hard drive.

    As I have Folder Redirection, "Desktop" and "Application Data" being redirected to Windows Server 2003 server, which goes to "E:\AppData" and "E:\Desktop"
    they both have quota template of 100MB and many of our students hit the limit, because they use DropBox.

    Now the issue is, It logs events such as Category "Quota" Event "104" - "A quota has been reached" now the stupid thing is, it records these messages into the "Security" Event Log. And I can't see any setting to NOT record any, or change them to another location in Event Viewer.
    I have a 1GB file limit on "Security" to record logon/logoff events as standard for a whole month. But the Quota has filled all 1GB in 5 hours, and got rid of all the logon/logoff events.

    And I can't really find what's making this, because it the 'File Server Management' there is a setting to put a record into Event Viewer, which records into the 'System' with category 'ntfs' information event. which is disabled, which I had enabled in the past.

    many thanks
    Pete

  • #2
    Re: Quota filling up 'Security' event log

    You can run GPResult or Group Policy Results from Group Policy Management to see if there is any GPO that still forces those events to be written.

    Comment


    • #3
      Re: Quota filling up 'Security' event log

      Can you set quotas on a folder in W2K3? I thought quotas only worked on volumes, not folders in W2K3. In any event, look at the logging checkboxes on the Quotas tab of the properties of the volume.

      Comment


      • #4
        Re: Quota filling up 'Security' event log

        Originally posted by joeqwerty View Post
        Can you set quotas on a folder in W2K3? I thought quotas only worked on volumes, not folders in W2K3. In any event, look at the logging checkboxes on the Quotas tab of the properties of the volume.
        Correct -- 2003 quotas are per user, per volume
        Last edited by Ossian; 12th May 2011, 16:38.
        Tom Jones
        MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
        PhD, MSc, FIAP, MIITT
        IT Trainer / Consultant
        Ossian Ltd
        Scotland

        ** Remember to give credit where credit is due and leave reputation points where appropriate **

        Comment


        • #5
          Re: Quota filling up 'Security' event log

          Originally posted by joeqwerty View Post
          Can you set quotas on a folder in W2K3? I thought quotas only worked on volumes, not folders in W2K3. In any event, look at the logging checkboxes on the Quotas tab of the properties of the volume.
          That's true, but there is some software from micronuts called 'File Server Management' for W2K3 where you can set quota's on volume or folder. available within add/remove components in the add/remove programs.

          Comment


          • #6
            Re: Quota filling up 'Security' event log

            and I am still unable to find anything that is recording these events into the Security Event Log.

            Comment


            • #7
              Re: Quota filling up 'Security' event log

              have a look here:
              http://support.microsoft.com/kb/228812

              It references a hive:
              \HKLM\System\CurrentControlSet\Control\FileSystem.

              I'm on a Win7 host, so I can't find a relevant option. but if you dig in that hive, on your server, you may find something suitable.


              or this:
              http://technet.microsoft.com/en-us/l...8WS.10%29.aspx
              references fsutil
              fsutil behavior query querynotify might help


              or tell it NOT to log when users exceed their quota
              http://technet.microsoft.com/en-us/l...8WS.10%29.aspx



              I'm also sure at some point in my life, I've found an option that allows you to choose which events could be redirected to a separate log - would require hacking the registry though
              Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

              Comment


              • #8
                Re: Quota filling up 'Security' event log

                Sorry,

                I am NOT using Disk Quota's so those links won't help me at all.

                But I am playing with regedit at the moment, to see if I can create a brand new QuotaEvent.evt and log all Quota events into it.
                But it doesn't seem to be work properly, but there is also a cmd line 'eventcreate' but I can't create a new log file with it.

                I even tried removing 'Quota' from the Security registry, but no luck just yet...

                Again, I am using 'File Server Management' for FOLDER Quota's on the same Volume.

                Comment


                • #9
                  Re: Quota filling up 'Security' event log

                  so this is a completely separate, external program you're using then?
                  Pls provide a link to the software?
                  Last edited by tehcamel; 11th May 2011, 13:01.
                  Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

                  Comment


                  • #10
                    Re: Quota filling up 'Security' event log

                    what I have found, is that the FSRM tool that comes with Windows Server 2003 R2 allows you to define appropriate alerting settings as part of the Quota Template.
                    Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

                    Comment


                    • #11
                      Re: Quota filling up 'Security' event log

                      Originally posted by tehcamel View Post
                      what I have found, is that the FSRM tool that comes with Windows Server 2003 R2 allows you to define appropriate alerting settings as part of the Quota Template.
                      As I mentioned already, all alerts are disabled and when enabled, the logs go into 'System' Log as 'NTFS' NOT security log as 'quota'...

                      but anyway, not a problem anymore.. ignoring it.

                      Ta.

                      Comment

                      Working...
                      X