|
Posted by Steven L Umbach on January 10, 2006, 7:34 pm
Please log in for more thread options It should work. You have to make sure the auditing of object access is
enabled for success first in Domain Controller Security Policy and you may
need to reboot the domain controller. -- Steve
>I tryed it works on my xp computer. But on windows 2003 PDC it do not work.
>No 560 event at all.
>
>
> 写入消息新闻:uAAgRGnEGHA.740@TK2MSFTNGP12.phx.gbl...
>> First use Local Security Policy [secpol.msc] or the domain/OU Group
>> Policy that enforces that setting or auditing of object access. Then
>> configure auditing on the folders you want to track the changes of for
>> the users/group and then for "change permissions" and look in the
>> security log for object access events, particularly event ID 560, that
>> refer to the folder in question for change permission. If the user is
>> system then a startup/shutdown Group Policy script, AT scheduled task,
>> Group Policy file system, or some other process using system could be
>> changing the permissions. Below is an example I just created on my
>> computer. Note the object name is a folder called log on drive E. Under
>> accesses note WRITE_DAC which most likely means write discretionary
>> access control. I did change permissions on that folder. You can use the
>> free Event Comb from Microsoft to help narrow the search by for instance
>> searching for event ID 560 and text string WRITE_DAC . The links below
>> explain ore. --- Steve
>>
>> http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
>> Comb
>>
>>
>> Event Type: Success Audit
>> Event Source: Security
>> Event Category: Object Access
>> Event ID: 560
>> Date: 1/5/2006
>> Time: 9:22:27 PM
>> User: STEVE-XP\Steve <<<<<<<<<<
>> Computer: STEVE-XP
>> Description:
>> Object Open:
>> Object Server: Security
>> Object Type: File
>> Object Name: E:\log <<<<<<<<<<<<
>> Handle ID: 2204
>> Operation ID:
>> Process ID: 1204
>> Image File Name: D:\WINDOWS\explorer.exe
>> Primary User Name: Steve
>> Primary Domain: STEVE-XP
>> Primary Logon ID: (0x0,0x1F85E4)
>> Client User Name: -
>> Client Domain: -
>> Client Logon ID: -
>> Accesses: READ_CONTROL
>> WRITE_DAC <<<<<<<<<<<
>> ReadAttributes
>>
>> Privileges: -
>> Restricted Sid Count: 0
>>
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>>> The folder secrity always change by somebody, somehow. I need know when
>>> and who. Is there a way I can do it?
>>>
>>
>>
>
>
| 
XML Sitemap