Audit Permission Changes

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Hi

We have a problem with users changing the permissions to folders on one of
our servers. I would like to Audit this but I am having problems finding
out exactly how to do this. Can anyone advise me?

Thank you in advance.

Steve

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

I first would make sure they do not excessive permissions to the folder. You need
full control for a folder and there is little reason for a regular user to have full
control. Check the advanced permissions to the folder also. To audit a folder you
need to first enable auditing of object access in the Local Security Policy on the
computer and then enable auditing on the folder or folder and look in the security
log for object access events such as 560 and 562. Note that enabling auditing of
object access and auditing a folder will generate a ton of events in the security
log. If you want to try it, enable auditing of just change permissions for the users
group that has access to the folder. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;301640

"SLingerUK" <Steve.Linger@his-herts.nhs.uk> wrote in message
news:eoJC97HdEHA.4092@TK2MSFTNGP10.phx.gbl...
> Hi
>
> We have a problem with users changing the permissions to folders on one of
> our servers. I would like to Audit this but I am having problems finding
> out exactly how to do this. Can anyone advise me?
>
> Thank you in advance.
>
> Steve
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Steve

Once again you've come up trumps!!! Thanks for your help.

Steve



"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
news:qgQNc.43498$8_6.5732@attbi_s04...
> I first would make sure they do not excessive permissions to the folder.
You need
> full control for a folder and there is little reason for a regular user to
have full
> control. Check the advanced permissions to the folder also. To audit a
folder you
> need to first enable auditing of object access in the Local Security
Policy on the
> computer and then enable auditing on the folder or folder and look in the
security
> log for object access events such as 560 and 562. Note that enabling
auditing of
> object access and auditing a folder will generate a ton of events in the
security
> log. If you want to try it, enable auditing of just change permissions for
the users
> group that has access to the folder. --- Steve
>
> http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
>
> "SLingerUK" <Steve.Linger@his-herts.nhs.uk> wrote in message
> news:eoJC97HdEHA.4092@TK2MSFTNGP10.phx.gbl...
> > Hi
> >
> > We have a problem with users changing the permissions to folders on one
of
> > our servers. I would like to Audit this but I am having problems
finding
> > out exactly how to do this. Can anyone advise me?
> >
> > Thank you in advance.
> >
> > Steve
> >
> >
>
>

 

[Guest]

I have worked on the exact issue and found a solution to audit through email.

Everytime any user touches the file / create / Modify / Delete a file I get alert through email.

Let me know if it sounds ok for you.

I can provide you a sample script.

Thanks & Regards,
Venu S.