Announcement

Collapse
No announcement yet.

file permission modified ,how to audit who modified the file

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • file permission modified ,how to audit who modified the file

    file permission modified ,user is removed form the security tab. where to check who removed the user accout from file properies -security tab

  • #2
    If you enabled auditing beforehand (in Group Policy then on the advanced security tab of the folder/file) you can look at the security logs. If you hadn't enabled it, you have no way of finding out
    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    PhD, MSc, FIAP, MIITT
    IT Trainer / Consultant
    Ossian Ltd
    Scotland

    ** Remember to give credit where credit is due and leave reputation points where appropriate **

    Comment


    • #3
      IF it enabled then how to check in event logs. any specific eventid ID?

      Comment


      • #4
        All in the security log - depending on what you audit, up to 20 events will be raised per operation. Event descriptions are obvious
        Tom Jones
        MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
        PhD, MSc, FIAP, MIITT
        IT Trainer / Consultant
        Ossian Ltd
        Scotland

        ** Remember to give credit where credit is due and leave reputation points where appropriate **

        Comment

        Working...
        X