Windows Forum

Ask something
Discussion Locked

auditing file deletions

0 helpful
3 replies

by natcat 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am trying to turn on auditing on file/folder access.
I have edited the domain security policy to enable object access auditing
I have edited the local security policy to audit the same thing. But I keep seeing the effective setting in the MMC as'no auditing'.
Then I changed the default GPO to enable auditing but still nothin.
There is 'no auditing" in the local security policy as the effective setting, and consequently there are no logs in rhe security logs.
How can I enable auditing ?

3 replies

by jose_12650

Try enabling audit object access and directory service access in the domain controller. After this operation. Go to the specific folder you want audited, right click the folder, click sharing, click security tab, you can remove the Everyone group or leave it there, click add button, click advanced tab, click find now, then from the dropdown box select the group or users you want audited, click OK leave the default permissions to Read and Execute, List Folder Contents and Read. Allow the policy to replicate, or better still restart your server.

by natcat

Note to all readers: You MUST on a DC, edit the Default Domain Controllers gpo via the Default Domain Controller Policy Tool MMC in order to have auditing setup.
On all NON DC computers you can use the GPO or the domain security policy and the local security policy to enable auditing of events.

This discussion is closed to new replies.