Audit file access

I want to audit file and folder access auditing on a windows 2008 server. I need to enable audit log all file activity by user such as read, copy, create, rename, deleted .
Is there a way to see if an user access a specific file ?
Thanks

Hey please have a look at these link for the reference.
http://social.technet.microsoft.com/Forums/windowsserver/en-US/b18ca99b-db07-4e2e-8f13-67d58a4d1c63/windows-2008-server-files-access-real-time-monitoring
Moreover, you can start from the several links from here also
http://technet.microsoft.com/en-us/library/dd408940%28v...
http://technet.microsoft.com/en-us/sysinternals/bb89664...
http://technet.microsoft.com/en-us/library/cc721946.asp...
And the other option is you can opt for a third party tool such as Lepide Auditor For File Server. A file Server monitoring tool that would help you in case for a real time monitoring.Test the tool from the given link below.
http://www.lepide.com/file-server-audit/
Thanks.

Similar Messages

Auditing all users file access - too much information

Hi, I have enabled a GPO With the following: Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access -> Audit File System -
Success on a file server.
After that, I have enabled successful Create files/Create Folders on a folder for the built-in group Everyone.
That part works fine, I can see when users are creating files on the folders. But I also get a lot of Extreme amounts of other events logged in the Security log, and everything is coming from the backup agent running on the server (NetBackup in this case).
How come that a backup agent is creating the events like this? It makes filtering much harder afterwards. The business requirements is to audit Everyone who is adding files to a specific folder, not all the rest of the server. The server
is Win2008 R2.
Example:
An attempt was made to access an object.
Subject:
Security ID: SYSTEM
Account Name: FILESERVER01$
Account Domain: MYDOMAIN
Logon ID: 0x3e7
Object:
Object Server: Security
Object Type: File
Object Name: \Device\HarddiskVolumeShadowCopy58\Windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7601.18619_none_d4cab625fb3adf96\audiosrv.dll
Handle ID: 0x3c4
Process Information:
Process ID: 0x1048
Process Name: C:\Program Files\VERITAS\NetBackup\bin\bpbkar32.exe
Access Request Information:
Accesses: WriteAttributes

Hi Steve,
I feel your pain, I turned on logging on a file server and found the security log filling 4GB in a couple of hours. I think the key is being very selective about what you audit. I found this article useful and it had some powershell and ideas for helping
make sense of the information overload - http://blogs.technet.com/b/mspfe/archive/2013/08/27/auditing-file-access-on-file-servers.aspx
In my opinion though you really need a third party solution to make this viable, two I've looked at are
Netwrix File Server Auditor and
FileAudit which seem very similar in functionality and ease of use. These basically read in the event log to provide long term archive and reporting on it.
Good luck,
Tim

Auditing failed access to files and folders in Windows Storage Server 2008 R2

Hello,
I've been trying to figure out why I cannot audit the failed access to files and folders on my server. I'm trying to replace a unix-based NAS with a Windows Storage Server 2008 R2 solution so I can use my current audit tools (the 'nix NAS
has basically none). I'm looking for a solution for a small remote office with 5-10 users and am looking at Windows Storage Server 2008 R2 (no props yet, but on a Buffalo appliance). I specifically need to audit the failure of a user to access
folders and files they are not supposed to view, but on this appliance it never shows. I have:
Enabled audit Object access for File system, File share and Detailed file share
Set the security of the top-level share to everyone full control
Used NTFS file permissions to set who can/cannot see particular folders
On those folders (and letting those permissions flow down) I've set the auditing tab to "Fail - Everyone - Full Control - This folder, subfolders and files"
On the audit log I only see "Audit Success" messages for items like "A network share object was checked to see whether client can be granted desired access (Event 5145) - but never a failure audit (because this user was not allowed access by NTFS permissions).
I've done this successfully with Windows Server 2008 R2 x64 w/SP1 and am wondering if anybody has tried this with the Windows Storage Server version (with success of course). My customer wants an inexpensive "appliance" and I thought this new
variant of 2008 was the ticket, but I can't if it won't provide this audit.
Any thoughts? Any of you have luck with this? I am (due to the fact I bought this appliance out of my own pocket) using the WSS "Workgroup" flavor and am wondering if this feature has been stripped from the workgroup edition of WSS.
TIA,
--Jeffrey

Hi Jeffrey,
The steps to setup Audit on a WSS system should be the same as a standard version of Windows Server. So please redo the steps listed below to see if issue still exists:
Enabling file auditing is a 2-step process.
[1] Configure "audit object access" in AD Group Policy or on the server's local GPO. This setting is located under Computer Configuration-->Windows Settings-->Security Settings-->Local Policies-->Audit Policies. Enable success/failure auditing
for "Audit object access."
[2] Configure an audit entry on the specific folder(s) that you wish to audit. Right-click on the folder-->Properties-->Advanced. From the Auditing tab, click Add, then enter the users/groups whom you wish to audit and what actions you wish to audit
- auditing Full Control will create an audit entry every time anyone opens/changes/closes/deletes a file, or you can just audit for Delete operations.
A similar thread:
http://social.technet.microsoft.com/Forums/en-US/winserverfiles/thread/da689e43-d51d-4005-bc48-26d3c387e859
TechNet Subscriber Support in forum |If you have any feedback on our support, please contact [email protected]

Server Directory/File Access Security Auditing - Is This Possible on OSX Server?

I am looking for a solution that will give me the ability to monitor/audit who access what file, when, and if possible, give alerts to the "owner" of the directory/file or to the system admin when someone access something on our OSX file server.

First of all lets call it Flash Media Interactive Server (adding Streaming becomes little confusing to readers as we have Flash Media Streaming Server) - both are FMS but two different edition.
Now coming to FMIS, you can place all your video files in "streams" directory of application in the simplest configuration and then use Server-side API Class "Stream" to play them. When you use Stream class to play VOD files, it basically becomes live publish and is available as live stream. I will give you simple code snippet which will explain what i am saying above:
var myStream;
application.onAppStart = function(){
     myStream = Stream.get("livestream");
     myStream.onStatus = function(info){
          trace("Info code:"+info.code);
    myStream.play("mp4:myvod.f4v",0,-1,true);
Now client will subscribe to live stream using stream name as "livestream" and it will basically get all the content of mp4:myvod.f4v
Say if you save above code in file named main.asc and place it in application folder named "test" on FMS, you will need to copy "mp4:myvod.mp4" inside "streams" i.e. create "_definst_" folder or any instance name folder under "streams" folder of "test" and place the file there
Hope this helps

Limiting file access auditing to specific users

I'd like to enable file system logging for specific users. Presently, under Advanced Audit Policy Config on the local file server (Win 2k8 R2 Std) I have enabled Audit File Share - but I get every users activity. I want to limit it to a few users.
As a test, I have added auditing to the security properties of a specific share, only for specific users, but that does not work if the Audit File Share isn't enabled. And if it is, I get all users activity. Any way to limit logging to specific
users? Thanks.

Hi Mike,
Based on my research, there are no system access control lists (SACLs) for shared files/folders, so that once we enable file share auditing, access to all shared files and folders on the system is audited.
More information for you:
Audit Detailed File Share
http://technet.microsoft.com/en-us/library/ee215206(v=WS.10).aspx
Audit File Share
http://technet.microsoft.com/en-us/library/dd772690(v=WS.10).aspx
Detailed File Share Auditing not working properly (Applying to All Files)
http://social.technet.microsoft.com/Forums/en-US/42618663-61cf-4c05-9659-80c162511cbf/detailed-file-share-auditing-not-working-properly-applying-to-all-files?forum=winservergen
Best Regards,
Amy

Auditing File and Folder Access Denied Attempts

The company I work for wants to be able to review audit logs to see where people have failed to gain access to particular folders or files on a server, that is part of a DFS. I have enabled Auditing Object Access with Failures, and I have added the Everyone
group to Auditing on the folder, in which it audits all failures. However, when I review the Security Log to see those failed attempts to access a file, for example, I get a log of a success to the user who attempted to open the file, when in actuality, he
failed to open the file because he did not have rights to open it.
What am I doing wrong, or is this how Microsoft has auditing setup?

Yes, myself and a nother technician have been unable to get this to work in a test environment or the real environment. We've created new users with nothing more than Domain User membership, and only list rights to the folder, which is how the real production
folder is setup. We still do not get failure notices when the attempt to access a file they don't have rights to access.
It does however, tell them on the client end that they have been denied access. It just doesn't show in the log.

Auditing File Deletion

On a SBS 2011 Server, I've enabled the Object Access Audit File System Success.
When checking the logs I see mostly read attributes activity.
Reading attributes seems to cloud the logs.
How can this be configured to capture only deletions, creations and updates?

Hi,
Just checking in to see if the suggestion was helpful. Please let us know if you would like further assistance.
TechNet Subscriber Support
If you are
TechNet Subscription
user and have any feedback on our support quality, please send your feedback
here.
Regards, Yan Li

Auditing file share on windows 2008 R2

I think I may need a little handholding here. I have been working with our new Windows 2008 R2 file server. I am having a problem doing some simple file level auditing.
I turned on Audit Object Access in the local policy. The GPO that applies to this server does not have it set and I only really need it enabled on this server. I have it auditing success and Failure.
After I did that I got deluged with Event ID: 5145. I went to each folder and made sure that I had auditing turned off for each folder and file. I did that to see if it would quite down the logs a little. It did not. I am currently getting about 1500 events of 5145 every second. They all say “ A network share object was checked to see whether client can be granted desired access”
Most of the details look like this:
- System
- Provider
   [ Name] Microsoft-Windows-Security-Auditing
   [ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}
   EventID 5145
Version 0
Level 0
   Task 12811
   Opcode 0
   Keywords 0x8020000000000000
- TimeCreated
[ SystemTime] 2009-10-21T17:27:06.988998000Z
   EventRecordID 4035441
   Correlation
- Execution
[ ProcessID] 528
[ ThreadID] 544
   Channel Security
   Computer XXXXX-File.XXXXX.com
   Security
- EventData
SubjectUserSid S-1-5-21-619530815-2141852887-1629300891-2071
SubjectUserName SteveW
SubjectDomainName XXXXXXXXXX
SubjectLogonId 0x223b087c
ObjectType File
IpAddress 10.2.50.88
IpPort 1087
ShareName \\*\users
ShareLocalPath \??\E:\shares\users
RelativeTargetName \
AccessMask 0x1
AccessList %%4416
AccessReason %%4416: %%1801 D:(A;OICI;FA;;;WD)
All I am trying to keep track of at this point is logon and logoff events AND files and folders being deleted.
If I have put this into the wrong folder please let me know.

Hi all,
I enabled File System Audit and NFTS audit only "Delete subfolders and files"
auditpol /get /category:"Object Access"
System audit policy
Category/Subcategory                      Setting
Object Access
File System                             Success and Failure
Registry                                No Auditing
Kernel Object                           No Auditing
SAM                                     No Auditing
Certification Services                  No Auditing
Application Generated                   No Auditing
Handle Manipulation                     No Auditing
File Share                              No Auditing
Filtering Platform Packet Drop          No Auditing
Filtering Platform Connection           No Auditing
Other Object Access Events              No Auditing
Detailed File Share                     No Auditing
I try to delete files but don't see any 4463 event.

Audit object access

Hello, I am trying to understand "Audit object access", I have it turned on and I am capturing all Success and Failures of every file share I have on our File Server.
However, that is my issue. I am capturing everything. Is there a way to only capture certain file shares. I noticed that under the auditing tab, its has "include inheritable auditing........"
Example:
In this example, I want to capture successes and failures for all users who access Events and Images folders.
\\Server1\Share1\Data1\Common\Reports\Events
\\Server1\Share1\Data1\Common\Apps
\\Server1\Share1\Data1\Images
Thank you for your help. .

Simply disable the current auditing on the root of your folders. Once done, enable it only on the folders you would like to audit.
Reading such logs is usually a difficult task and time consuming. For that, it is recommended to use a third party tool with a UI for auditing. The one I usually recommend is Lepide Auditor for File Server: http://www.lepide.com/file-server-audit/
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Not Working: BlackBerry Link Remote File Access Remove Old BlackBerry from BB ID

I have: removed my blackberry q10 from blackberry link, wiped my q10, uninstalled and reinstalled blackberry link, have link version 1.1.1.32, blackberry q10 os version 10.1.0.2309 - which whenever I plug in the q10 after removing the device from link, says there is an os update, so I update it, and then it does nothing apart from rebooting the q10, or gives an error saying 'updates not available. Please check internet connection and retry.'.
Also, I have Logout/login on blackberry link, I know my q10 is activated as I have purchased items from app world, and on the computer the app world site shows that I have a q10 when I sign in. I am using the same BBID and have changed the password on my q10 to see if that made a difference, then signed out and back into link on computer with updated password. I have administrator rights on my computer.
I can access the q10 from my computer over the same wifi network, and it syncs files fine with wireless sync turned on. It is remote file access not giving the option to connect to my q10. 'BBID *email* isn't associated with a device running Blackberry 10 OS or an error occurred when trying to retrieve your information from the Blackberry ID servers.'
The problem is that although I have the same blackberry id for link and my q10, no devices show up on the remote file access screen, and I cannot access my files on my computer from my q10, yet I can sync them on my computer over the wifi network. How can I enable Remote File Access?
A problem could be that I have a Curve 9300 on my BB ID account, so if I could disable this (which I have no idea how to do after a lot of research), this might rectify why link cannot set up remote file access.
What I haven't done is wiped my q10 and uninstalled all user data from link at the same time, as then I would have to manually reload everything on my q10.
My q10 shows my computer in the settings\blackberry link\paired devices , but I 'cannot view files on *computer*'. Also, link does not show in the file manager. I set up my q10 as a permanent link not a one-off connection.

No one cares because it's not a z10 (I know because I am having the same problem and no one knows how to fix it and no threads for q10 fix)
Slàinte.
Not all things are good.
Not all things are evil.
But with an open mind...
You can see the difference.
Knowledge is power.

Read-only file access from network volume

I get an read-only file access from network volume problem while sharing a drive from Snow Leopard to a Tiger install. Most of files were opening well, but *.fp7 (FileMaker) and *.xls (Excel) files won't open dealing with a read-only error.
As descibed in the last post of http://discussions.apple.com/thread.jspa?threadID=1406977 the client have the same share name of the server. Renomming it resolved the error!
Thanks!

right then, as it looks like I'm talking to myself....
I have just wiped clean the Macbook Pro.
I installed Leopard from scratch, then installed Office 2008.
Logged back onto the network share, and the read-only error came up again, ONLY in Excel.
bugger.
Did the same thing with my Macbook and all is fine.
Copy the file to the local hard drive, opens ok.
I then copied the file to another Mac on the network.
mmmm, opens fine.
what's the difference....
mmmm, the machine it opens fine from is running 10.4
the machine which hosts all the data is running 10.3.9
could this be the problem.
Just done a software update check on the 10.3 machine and there are some security updates that need doing.
Going to run that now and see what happens, otherwise I think the iMac running 10.3.9 is going to need to come up to 10.4 and fingers crossed this will solve it.

Auditing file server setup issues - nfs permissions

I have half-dozen Solaris 10 workstations requiring Solaris Auditing enabled and audit files saved. I used a spare Solaris 10 system with 2-72GB disks and formatted 2nd disk for entired 72GB. I shared out the 72GB partition on this system and modified /etc/security/audit_control on a test Solaris 10 W/S to use the shared-out partition on Audit file server as primary audit directory. Following directions in Solaris 10 Admin Gde I chmod -R 750 the mount pt using the 72GB partition before sharing out the partition. However, all client W/S's that I enable Auditing would not use the 72GB partition on file server until I went back and chmod 777 the partition and rebooting file server. Also, on any client that I have enabled Auditng to use nfs-mounted 72GB partion on file server I cannot as a non-root user issue a "df -k" command without getting error:
df: cannot statvfs /var/audit/fmaud.1/files: Permission denied
Is this normal or did I miss a chmod step or two in setting up Audit clients and/or Audit file server?

The roundcube db schema needs to setup manually. See /usr/share/webapps/roundcube/INSTALL
Also, from your /etc/webapps/postfixadmin/config.inc.php:
$CONF['domain_path'] = 'NO';
$CONF['domain_in_mailbox'] = 'YES';
$CONF['maildir_name_hook'] = 'NO';
..which results in /var/mail/vmail/[email protected]
From your dovecot.conf
mail_home = /var/mail/vmail/%d/%u
...which results in /var/mail/vmail/domain.com/user
That doesn't fit together.

Sql agent job getting file access denied error

I'm not sure if this question belongs in this forum. Please move it if you want to.
Here is my question. I have an ssis package that is running into an error at the file system task trying to move a file. The package is deployed to the catalog and I am running the package using the stored procedure
[SSISDB].[catalog].[start_execution] @execution_id
When I execute this stored proc in Management Studio while logged in under a sysadmin, everything works fine. But when I call the same TQL in SQL Agent job, I get a file access denied error. This has something to do with the id that is getting used
to run the package and I am not sure how to track that down. Any help would be appreciated.
I've check the windows permission on both the id that is running the SQL Agent and SQL SSIS Service. Both seem to have the right windows permission.

Please see:
http://support.microsoft.com/kb/918760

MaxDB KNLDIAG file access denied

Hi,
I'm a DBA recently assigned to support MaxDB database (ver 7.6) used by
SAP Content Server in our windows 2003/32 bit environments.
Initially, our windows support group granted the DBA group access to
the files on E:\sapdb\data\wrk\CD1 where the KNLDIAG and other files
are allocated. We were able to view the KNLDIAG file when errors
occurred.
However, when the database instance is placed offine and back online,
we loose access to the KNLDIAG file, but not the other files on the
same directory/subdirectory.
Can you explain what is happening?
Is MaxDB doing something behind the scenes?
What can be done so that we don't loose access to this file?
I would appreciate any help you can provide.
Regards,
Bill

Hi Bill!
> I'm a DBA recently assigned to support MaxDB database (ver 7.6) used by
> SAP Content Server in our windows 2003/32 bit environments.
> Initially, our windows support group granted the DBA group access to
> the files on E:\sapdb\data\wrk\CD1 where the KNLDIAG and other files
> are allocated. We were able to view the KNLDIAG file when errors
> occurred.
> However, when the database instance is placed offine and back online,
> we loose access to the KNLDIAG file, but not the other files on the
> same directory/subdirectory.
>
> Can you explain what is happening?
Yes, no problem!
> Is MaxDB doing something behind the scenes?
Of course not - it's well documented
Unlike Oracle MaxDB does not use the same file all the time to write out the error messages.
Instead, with every restart the last file 'KLNDIAG' (and/or 'KNLMSG' in more recent versions) is renamed to 'KNLDIAG.OLD'. If there is already an 'KNLDIAG.OLD' this file is gone afterwards.
Then a new file is 'KNLDIAG' is created by the MaxDB Kernel with the default permission of the folder.
Usually these are dictated by the Windows account that runs the MaxDB-Service.
If you did not change this, this would be the "local systemaccount".
On my test system this results in default permissions that allow members of "Adminstrators", "Backup Operators", "System" and of course the "Owner/Creator" to access the file.
> What can be done so that we don't loose access to this file?
Simple: if you want to access it via OS tools, make sure that the user is a member of the "Administrators" or the "Backup Operators" group.
If you don't want to do that, just use the file access via the DBMGUI or DB Studio (or DBMCLI) to get access to the file.
regards,
Lars
p.s.
Maybe you didn't notice that by now - the KNLDIAG file is not simply written at the end of the file, but consists of a startup header part and a body which is cyclically overwritten.
For any newbies I cannot overstate the importance of reading the documentation [http://maxdb.sap.com] and/or get a training for it (SAP course ADM 515 really pays of here...)

Server 2008r2 and windows 7 pro slow to no networkshare file searching and file access (green progress bar)

we are running a windows server 2008r2 sp1 domain controller and a 3com gigabit switch to which 7 windows 7 pro computers are connected. We are only using the windows server to distribute a few printers and as a network share (z drive).
we are storing all files (word documents only) centrally on the server (z share), and files are accessed and written to the z share.
Problem is that file access from the z share on the windows 7 client computers is at best buggy. we are able to browse the z-share, but as soon as we want to search the z-share for files (f.i. use file explorer with "content: memorandum") the green
progress bar shows and no search is performed. something like alphabetically sorting a directory on map/file name on the z-share also shows a green bar with no sorting. manually going to the files works.
One thing i noticed, sometimes not all files that one user created and stored on the server is visible and can be found by another user. I prefer to disable all offline file caching setting, because that feature is not used. no files should be made accessible
offline. i don't know where to change that on the server side.
I am reluctant to experiment on the server end (2008r2 sp1), so i tried a few suggested solutions on the client end (windows 7 client)
I tried disabling offline file caching
i tried properties (z share) ==> advanced and map optimizing and several options there
i tried disabling the smbv2 protocol and disabling the smbv1 protocol (using
sc.exe config lanmanworkstation depend= bowser/mrxsmb10/nsi command etc. posted by microsoft)
i tried disabling windows defender
i tried accessing the z share via ip and server name (the share is mapped via its servername, e.g. dennis-dc1\share). still the same
file searching on the clients c drive ('own harddrive') works much better, file searching on the server also works.
any suggestions or solutions that i can test on the client side, as mentioned i am reluctant to change something on the server side. if a solutions works, i prefer to change it on the server side.

Hi,
The issue could be due to windows indexing service taking long time in sorting and searching in mapped drives. Please try the steps belwo to disable windows indexing service or search service on the windows 7 client to resolve the issue.
You can click on Start and select Control Panel, click on
Programs and Features, go into the Turn Windows Features on or off section Scroll down the list and uncheck the box next to Indexing Service or Windows Search.
Best Regards,
Mandy
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Audit file access

Similar Messages

Maybe you are looking for