Windows Forum

Ask something
Discussion Locked

Directory Auditing issue in NT 4.0

0 helpful
7 replies

by pgdkansas 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

One of our administrators is attempting to audit a drectory (\\fsv01\Tools)
After all auditing properties are set, an error is logged in Event Viewer that the auditing cannot take place (no specific error message is givin) and auditing is not performed on this directory. He checked the directory properties and Auditing is ON, but it never gets audited. (He has set all default options on this audit.)

He has logged off and back on as himself and local administrator. He has Administrator privilages to EVERYTHING so I don't think it is a rights issue.

This box is running Nt 4.0 with the latest spk release.

We have tried all the obvious fixes already, that's why I am awarding more points to this one.
Anyone have any ideas??

7 replies

by avachon

Hi, okay, auditing is enabled on the directory, which it needs to be, but is auditing also enabled under user manager for domains? Under user manager for domains, go under policies | audit | click on enable auditing and then select the events you want to audit and whether you want a log of successful or unsuccessful events (and check your security log frequently; depending on what you select the event viewer security log can fill quickly). Hope this helps.

by pgdkansas

Auditing has been enabled in UMD and on the directory itself. Still, it does not want to cooperate.
Thank you for the input and keep getting involved. This was a good suggestion.

by shmaltz

Is the File System FAT or NTFS. You can not audit a file thats on a FAT partition.

by shmaltz

Also; try by taking ownership of the file.
If this helped then you will have to use the user rights to give this person the right to audit.

by pgdkansas

I checked your suggestions and everything was already done.

Thanks for the input, though. It was a good place to look

by pgdkansas

As it turned out, I was missing a registry key for "Profiles". Because this particular profile was never registered in the system, auditing would not work even though everything was set up properly in GUI.

Thanks for all the input, but I have torevoke the points. Better luck next time.

This discussion is closed to new replies.