|
Posted by Hugo on February 13, 2007, 2:19 pm
Please log in for more thread options Hi Dave !
I found what I'm missing !
I activated "Change Permission" on the D: drive for my server... The Event
Log I got were all for temporary file created by Word/Excell etc... So, when
Word create a temporary file, Windows assign it an ACL (changing permission)
and this is what I got in the Event Log !!!
Thank you !
Hugo
1171386726.646822.277710@p10g2000cwp.googlegroups.com...
> >
>> >> What can I do to not have those events in my event log ?
>>
>> >> I want to monitor only one directory on D: drive...
>>
>
> The system will not audit any object access unless there is a SACL
> specifying the audit action. So, the entries you are seeing are caused
> by a SACL, you just have to find it. There are default SACLs on the
> system, but they won't do anything until the security policy to enable
> object access auditing is enabled. On one server here there is such a
> default SACL on the registry key that contains the paramaters for the
> security log.
>
> When you enable auditing in security policy you start getting these:
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: Object Access
> Event ID: 560
> Date: 2/13/2007
> Time: 8:55:08 AM
> User: EXTRANET\Administrator
> Computer: EXTRANETDC
> Description:
> Object Open:
> Object Server: Security
> Object Type: Key
> Object Name: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog
> \Security
> Handle ID: 896
> Operation ID:
> Process ID: 3044
> Image File Name: C:\WINDOWS\system32\mmc.exe
> Primary User Name: Administrator
> Primary Domain: EXTRANET
> Primary Logon ID: (0x0,0x1C353)
> Client User Name: -
> Client Domain: -
> Client Logon ID: -
> Accesses: Set key value
>
> Privileges: -
> Restricted Sid Count: 0
> Access Mask: 0x2
>
>
> If you use regedt32 to view this registry setting and click advanced/
> permissions/auditing you'll see there is a SACL on the object. If you
> were to remove the SACL you'll stop getting these particular audits.
>
> Something similiar is happening on your file volumes. If you look
> around you'll probably find an inheritable SACL. For any particular
> path that generates an audit you should be able open that file's
> properties and find a SACL either explicitly on the object or one that
> is being inherited.
>
> HTH.
>
> Dave
>
| 
XML Sitemap