I would like to implement auditing on a shared folder, to find who can or can’t delete files/folders and read files/folders.
I set this up in a test environment and it works. However, in my production environment, events are not logged at all.
I go through the following steps:
– Create a shared folder on the DC and assign the proper permissions to it.
– Go into the domain controller security policy and enabled auditing for object access (success and failure)
– Run ‘secedit /refreshpolicy machine_policy’ to refresh the group policy.
– Enable auditing on the folder for the Everyone group, and allow the auditing to propergate down.
– Access the share as a user and try to open a folder I don’t have access to, and delete files.
– When I check the Event Viewer, there’s no events at all.
I followed the same steps on the test server again and it works. When I check the event viewer there, I see the entries.
This is a Windows 2000 AD environment, with 2 DCs.