Prev: Upgrading Server 2008 core to 2008 R2 core?
Next: dc as a file server
From: techstress on 14 Apr 2010 12:25
We would like to monitor the movement or deletions of files and
folders on the user data volume of our file server. do you guys/gals
know of any best practices for this?
From: Meinolf Weber [MVP-DS] on 14 Apr 2010 15:18
Hello techstress,

You have to enable folder/file auditing, see here from another posting:
-------------------------------------------------------------------------------------------
Enabling file auditing is a 2-step process.

[1] Configure "audit object access" in AD Group Policy or on the server's
local GPO. This setting is located under Computer Configuration-->Windows
Settings-->Security Settings-->Local Policies-->Audit Policies. Enable success/failure
auditing for "Audit object access."

[2] Configure an audit entry on the specific folder(s) that you wish to audit.
Right-click on the folder-->Properties-->Advanced. From the Auditing tab,
click Add, then enter the users/groups whom you wish to audit and what actions
you wish to audit - auditing Full Control will create an audit entry every
time anyone opens/changes/closes/deletes a file, or you can just audit for
Delete operations.

After you've done both of these steps, any file deletions will show up in
the Security log of the file server that hosts those files.

HTH
-------------------------------------------------------------------------------------------

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> We would like to monitor the movement or deletions of files and
> folders on the user data volume of our file server. do you guys/gals
> know of any best practices for this?
>


 | 
Pages: 1
Prev: Upgrading Server 2008 core to 2008 R2 core?
Next: dc as a file server