Click here to get back home

Audit policy problem (deleted file name)

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Audit policy problem (deleted file name) Mavieksen 05-28-2007
Posted by Mavieksen on May 28, 2007, 7:21 am
Please log in for more thread options

Hi,

i am trying to using audit poliy for files and folder (in win2003 domain)..

i saw security events successufully about accessed files (who accessed, when
accessed, ..) also true location and file name; for example
D:\new folder\document.doc

but i couldn't see file name when i deleted any file; i just saw that
"explore.exe" as file name :(
for example
D:\new folder\explorer.exe

i want to see that deleted file names when a user delet it truly...

What can i do ?

Thanks for everythings...

Posted by Roger Abell [MVP] on May 28, 2007, 4:00 pm
Please log in for more thread options
Tell us what audit settings you are using for files.
For example, audit Full Control success by Everyone.


>
> Hi,
>
> i am trying to using audit poliy for files and folder (in win2003
> domain)..
>
> i saw security events successufully about accessed files (who accessed,
> when
> accessed, ..) also true location and file name; for example
> D:\new folder\document.doc
>
> but i couldn't see file name when i deleted any file; i just saw that
> "explore.exe" as file name :(
> for example
> D:\new folder\explorer.exe
>
> i want to see that deleted file names when a user delet it truly...
>
> What can i do ?
>
> Thanks for everythings...



Posted by Mavieksen on May 29, 2007, 1:04 pm
Please log in for more thread options
i am using Full control success and failure by authenticated users


"Roger Abell [MVP]" wrote:

> Tell us what audit settings you are using for files.
> For example, audit Full Control success by Everyone.
>

Similar ThreadsPosted
How do I tell which user deleted a file? December 13, 2006, 12:37 pm
File Access Audit on File Server June 20, 2007, 4:59 pm
Audit Policy Settings February 8, 2006, 3:46 pm
Detail display for audit policy December 19, 2006, 9:06 pm
Audit Policy (security logs) August 20, 2007, 10:18 pm
Windows 2003 audit Policy amended October 29, 2006, 7:32 pm
Audit file/folder access February 12, 2007, 10:52 am
use of Issuance policy in capolicy.inf file January 19, 2008, 5:54 pm
Windows 2003 Problem with Group Policy for Services Startup and Permissions April 27, 2006, 7:27 am
Deleted files July 18, 2006, 7:50 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap