|
Posted by Roger Abell [MVP] on September 1, 2005, 7:47 pm
Please log in for more thread options
When you enabled auditing on the underlying storage, you both set
SACL on the storage and changed (directly or via GPO) the local
security policy Auditing setting so that Success and Failure are
enabled for Audit object access ? You must do both.
--
Roger
>I would like to know who is accessing a server share. For example, I
> have a Windows 2000 Server and a share called Public. When someone
> successfully reads or writes to this share, I would like to log the
> person who accessed it.
>
> I thought enabling auditing of success events on the server would do
> the trick, but it did not.
>
> I would appreciate any suggestions for techniques, scripts, or
> commercial products.
>
> Regards,
> Matthew
>
| 
XML Sitemap