Windows Forum

Ask something
Discussion Locked

NT Auditing question

0 helpful
8 replies

by bwatson

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am auditing success and failures on several private user folders on my network. Recently I have been getting failure audit messages on these private folders with one users name on all of them. My problem is that the user denies the access attempts. My question is: Is there a way to identify the MACHINE, rather than the user that attempted the access to these folders. Is there a MAC address somewhere in the failure auditing that I can't find? Is there something else I can turn on? Any help would be greatly appreciated.

8 replies

by rdubrey

Hmm, seems to me that on a secure network the USER information would be enough unless users share their accounts. I think that you would probably have to use Network Monitor and monitor certain packets from the machine in question. Hope that helps. Rob

by bwatson

The problem is we believe there may be a possiblity that another user got access to an admistrative folder that contained a password list file. We are trying to disprove that theory by associating the attempts with a particular machine.

by cdeclercq

I have the same thing happen. The problem likely lies in the user doing a find above that directory. Everytime you do a find, on a file that is audited and denied, there is a failure audit created. Same deal with folders on Explorer. This is a setup question. Do the private folders exist as subfolders to a share that the blamed user has access to? if so there you go. All private shares should be located at the same level with no access to the upper level directories from anything but administrators.

by bwatson

Although your answer wasn't the exact situation it was close. It turns out that a program called Persuasive SQL was actually accessing those files as part of its process to build it's database. Lots of fun figuring that one out. Thanks for your help, we did actually recreate the situation doing just what you suggested.

This discussion is closed to new replies.