Audit object access

Archived from groups: microsoft.public.win2000.security (More info?)

I am afraid not. When you enable auditing of object access you will also see
what may seem to be many unrelated events recorded in the security log but
that is normal. What you may find helpful is to use Event Comb which is
available at the link below. You can for instance use it to search for only
security events with the word "delete" in them which will greatly narrow the
search for you.--- Steve

http://www.microsoft.com/downloads [...] laylang=en

"SuderMan" <SuderMan@discussions.microsoft.com> wrote in message
news:C37CA282-8730-455E-86CE-9824167D1E3A@microsoft.com...
> Hello !
>
> I have a problem with auditing.
>
> Auditing is set on some folder and generally it's working
> but as I enable auditing for deleting files and folders only
> auditing works also on all kind of other access not only deleting.
>
> for example when I create a file within audited folder
> this kind of access is also audited (put into the logs)
> Is it possible to do it this way that only deleting folders or files will
> be
> put into logs ?
>
> Thank You
>
>