Operating System - Microsoft
cancel
Showing results for 
Search instead for 
Did you mean: 

Establishing Auditing

SOLVED
Go to solution
Edgar Zapata
Esteemed Contributor

Establishing Auditing

I need to establish auditing to a folder in some 300 servers.
I have found the auditpol.exe command line tool at the following URL:
http://www.cert-in.org.in/knowledgebase/presentation/16thapril04/securingwindows2000.pdf
Which allows me to enabling auditing for object access.

Next thing I need is to establish or indicate the folder I want auditing established in.

Anyone knows HOW I can do this?

Tnks.
5 REPLIES
Phil.Howell
Honored Contributor

Re: Establishing Auditing

When auditing is turned on, then audit events are put in the event log. This (like Gaul) is divided into three parts - System, Application, and Audit. Event logs are of a defined size and then overwrite oldest events. For Auditing you may need to run a script to copy and clear Audit events, or there are tools that direct them to a syslog
The attached script is from
http://www.microsoft.com/technet/scriptcenter/findit.mspx
this one does Application events so you will have to change it for Audit events.
Phil
Phil.Howell
Honored Contributor

Re: Establishing Auditing

or did you mean
How do I turn auditing on for a specific folder?
Right-click, Properties, Security Tab, Advanced, Auditing Tab, Add "everyone", and then tick the relevant boxes that you want to audit.
Phil
Ivan Ferreira
Honored Contributor
Solution

Re: Establishing Auditing

You can also use the setacl.exe command to establish auditing.
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Lucky Luciano
Regular Advisor

Re: Establishing Auditing

In case if there are 300 servers I would predict that Active Direcotory is there and I would use Group Policy
http://technet2.microsoft.com/WindowsServer/en/Library/3b5204b3-8b18-4b14-babd-a81532331af61033.mspx
But this works only for W2k3 I think
Hope it is working I found it there, I admire silently having sooooo many servers to play with :-)))
I admire your fashionable running shoes!
Edgar Zapata
Esteemed Contributor

Re: Establishing Auditing

Phil,
Thank you. I didn't mean to establishing auditing through a GUI, though. I was rather asking for a command.
Ivan, thank you much. That's exactly what I was looking for. Plus, setacl.exe tool allows me to solve out a totally different issue I had pending.
Peter, I might need to use your GPO stuff too.

Thank you.