topic Re: Establishing Auditing in Operating System - Microsoft

Establishing Auditing

Edgar Zapata — Fri, 05 May 2006 06:45:12 GMT

I need to establish auditing to a folder in some 300 servers.
I have found the auditpol.exe command line tool at the following URL:
http://www.cert-in.org.in/knowledgebase/presentation/16thapril04/securingwindows2000.pdf
Which allows me to enabling auditing for object access.

Next thing I need is to establish or indicate the folder I want auditing established in.

Anyone knows HOW I can do this?

Tnks.

Re: Establishing Auditing

Phil.Howell — Fri, 05 May 2006 07:41:42 GMT

When auditing is turned on, then audit events are put in the event log. This (like Gaul) is divided into three parts - System, Application, and Audit. Event logs are of a defined size and then overwrite oldest events. For Auditing you may need to run a script to copy and clear Audit events, or there are tools that direct them to a syslog
The attached script is from
http://www.microsoft.com/technet/scriptcenter/findit.mspx
this one does Application events so you will have to change it for Audit events.
Phil

Re: Establishing Auditing

Phil.Howell — Fri, 05 May 2006 07:50:39 GMT

or did you mean
How do I turn auditing on for a specific folder?
Right-click, Properties, Security Tab, Advanced, Auditing Tab, Add "everyone", and then tick the relevant boxes that you want to audit.
Phil

Re: Establishing Auditing

Ivan Ferreira — Fri, 05 May 2006 08:38:16 GMT

You can also use the setacl.exe command to establish auditing.

Re: Establishing Auditing

Lucky Luciano — Sun, 07 May 2006 13:55:55 GMT

In case if there are 300 servers I would predict that Active Direcotory is there and I would use Group Policy
http://technet2.microsoft.com/WindowsServer/en/Library/3b5204b3-8b18-4b14-babd-a81532331af61033.mspx
But this works only for W2k3 I think
Hope it is working I found it there, I admire silently having sooooo many servers to play with :-)))

Re: Establishing Auditing

Edgar Zapata — Mon, 08 May 2006 02:41:30 GMT

Phil,
Thank you. I didn't mean to establishing auditing through a GUI, though. I was rather asking for a command.
Ivan, thank you much. That's exactly what I was looking for. Plus, setacl.exe tool allows me to solve out a totally different issue I had pending.
Peter, I might need to use your GPO stuff too.

Thank you.