Announcement

Collapse
No announcement yet.

Enable Audit Object Access on file server

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Enable Audit Object Access on file server

    I was enable object access on local security policy , I was setting audit this folder . when i see the log file event ID 5145 show detail about user read file or read attribute . But i need to know who move , modify , create file in folder . I don't need to know event ID 5145 , Please help to advise ?

    https://technet.microsoft.com/en-us/...(v=ws.10).aspx


    Last edited by momaydopod; 25th October 2016, 10:33.

  • #2






    My log inform user read file only , Don't have information about Modify , Move , Edit , Delete








    Event ID 5140

    A network share object was accessed.

    Subject:
    Security ID: MyDomain\User
    Account Name: User
    Account Domain: MyDomain
    Logon ID: 0x1f71cec

    Network Information:
    Object Type: File
    Source Address: xx.xx.26.142
    Source Port: 49552

    Share Information:
    Share Name: \\*\IPC$
    Share Path:

    Access Request Information:
    Access Mask: 0x1
    Accesses: ReadData (or ListDirectory)

    ============================================
    Event ID 5145

    A network share object was checked to see whether client can be granted desired access.

    Subject:
    Security ID: MyDomain\User
    Account Name: User
    Account Domain: MyDomain
    Logon ID: 0x171ffdd

    Network Information:
    Object Type: File
    Source Address: xx.xx.26.95
    Source Port: 64143

    Share Information:
    Share Name: \\*\IPC$
    Share Path:
    Relative Target Name: spoolss

    Access Request Information:
    Access Mask: 0x12019f
    Accesses: READ_CONTROL
    SYNCHRONIZE
    ReadData (or ListDirectory)
    WriteData (or AddFile)
    AppendData (or AddSubdirectory or CreatePipeInstance)
    ReadEA
    WriteEA
    ReadAttributes
    WriteAttributes

    Access Check Results:
    -

    Comment


    • #3
      Check share permissions as by default these now only give read access to users

      Comment


      • #4
        Originally posted by wullieb1 View Post
        Check share permissions as by default these now only give read access to users
        Nope i setting there group user can access read and write

        Comment

        Working...
        X