General discussion

Locked

auditing file deletions

By NatCat ·
I am trying to turn on auditing on file/folder access.
I have edited the domain security policy to enable object access auditing
I have edited the local security policy to audit the same thing. But I keep seeing the effective setting in the MMC as'no auditing'.
Then I changed the default GPO to enable auditing but still nothin.
There is 'no auditing" in the local security policy as the effective setting, and consequently there are no logs in rhe security logs.
How can I enable auditing ?

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

auditing file deletions

by jose_12650 In reply to auditing file deletions

Try enabling audit object access and directory service access in the domain controller. After this operation. Go to the specific folder you want audited, right click the folder, click sharing, click security tab, you can remove the Everyone group or leave it there, click add button, click advanced tab, click find now, then from the dropdown box select the group or users you want audited, click OK leave the default permissions to Read and Execute, List Folder Contents and Read. Allow the policy to replicate, or better still restart your server.

Collapse -

auditing file deletions

by NatCat In reply to auditing file deletions

Note to all readers: You MUST on a DC, edit the Default Domain Controllers gpo via the Default Domain Controller Policy Tool MMC in order to have auditing setup.
On all NON DC computers you can use the GPO or the domain security policy and the local security policy to enable auditing of events.

Collapse -

auditing file deletions

by NatCat In reply to auditing file deletions

This question was closed by the author

Back to Windows Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums