Windows Forum

Ask something
Discussion Locked

Auditing events not captured

0 helpful
3 replies

by quintar51

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I would like to implement auditing on a shared folder, to find who can or can't delete files/folders and read files/folders.

I set this up in a test environment and it works. However, in my production environment, events are not logged at all.

I go through the following steps:

- Create a shared folder on the DC and assign the proper permissions to it.
- Go into the domain controller security policy and enabled auditing for object access (success and failure)
- Run 'secedit /refreshpolicy machine_policy' to refresh the group policy.
- Enable auditing on the folder for the Everyone group, and allow the auditing to propergate down.
- Access the share as a user and try to open a folder I don't have access to, and delete files.
- When I check the Event Viewer, there's no events at all.

I followed the same steps on the test server again and it works. When I check the event viewer there, I see the entries.

This is a Windows 2000 AD environment, with 2 DCs.

3 replies

by cg it

Use Audit object access in the domain security policy. audit the folder for who you want to find out who is doing what.

results are in the Event Viewer.

the problem you run into stems from DC policy vs domain policy.

by quintar51

Domain policy doesn't apply to DCs, which where the files are stored; hence I configured it on the DC policy. Anyways, I came back an hour later and events were showing up now and working. I guess GP wasn't refreshed by the secedit command, although I've always done it that way in the past. Thanks anyways!

This discussion is closed to new replies.