Audit Permission Changes

Archived from groups: microsoft.public.win2000.security (More info?)

Hi

We have a problem with users changing the permissions to folders on one of
our servers. I would like to Audit this but I am having problems finding
out exactly how to do this. Can anyone advise me?

Thank you in advance.

Steve
3 answers Last reply
More about audit permission changes
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    I first would make sure they do not excessive permissions to the folder. You need
    full control for a folder and there is little reason for a regular user to have full
    control. Check the advanced permissions to the folder also. To audit a folder you
    need to first enable auditing of object access in the Local Security Policy on the
    computer and then enable auditing on the folder or folder and look in the security
    log for object access events such as 560 and 562. Note that enabling auditing of
    object access and auditing a folder will generate a ton of events in the security
    log. If you want to try it, enable auditing of just change permissions for the users
    group that has access to the folder. --- Steve

    http://support.microsoft.com/default.aspx?scid=kb;en-us;301640

    "SLingerUK" <Steve.Linger@his-herts.nhs.uk> wrote in message
    news:eoJC97HdEHA.4092@TK2MSFTNGP10.phx.gbl...
    > Hi
    >
    > We have a problem with users changing the permissions to folders on one of
    > our servers. I would like to Audit this but I am having problems finding
    > out exactly how to do this. Can anyone advise me?
    >
    > Thank you in advance.
    >
    > Steve
    >
    >
  2. Archived from groups: microsoft.public.win2000.security (More info?)

    Steve

    Once again you've come up trumps!!! Thanks for your help.

    Steve


    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    news:qgQNc.43498$8_6.5732@attbi_s04...
    > I first would make sure they do not excessive permissions to the folder.
    You need
    > full control for a folder and there is little reason for a regular user to
    have full
    > control. Check the advanced permissions to the folder also. To audit a
    folder you
    > need to first enable auditing of object access in the Local Security
    Policy on the
    > computer and then enable auditing on the folder or folder and look in the
    security
    > log for object access events such as 560 and 562. Note that enabling
    auditing of
    > object access and auditing a folder will generate a ton of events in the
    security
    > log. If you want to try it, enable auditing of just change permissions for
    the users
    > group that has access to the folder. --- Steve
    >
    > http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
    >
    > "SLingerUK" <Steve.Linger@his-herts.nhs.uk> wrote in message
    > news:eoJC97HdEHA.4092@TK2MSFTNGP10.phx.gbl...
    > > Hi
    > >
    > > We have a problem with users changing the permissions to folders on one
    of
    > > our servers. I would like to Audit this but I am having problems
    finding
    > > out exactly how to do this. Can anyone advise me?
    > >
    > > Thank you in advance.
    > >
    > > Steve
    > >
    > >
    >
    >
  3. I have worked on the exact issue and found a solution to audit through email.

    Everytime any user touches the file / create / Modify / Delete a file I get alert through email.

    Let me know if it sounds ok for you.

    I can provide you a sample script.

    Thanks & Regards,
    Venu S.
Ask a new question

Read More

Security Microsoft Windows