Simple auditing for a folder - easier said than done!

In an attempt to audit for success and failure on a folder on a client workstation, I'm having problems.
I have defined within a GPO, an advanced audit configuration policy for 'Audit File System' under the 'Object Access' section of the available advanced audit nodes. I have also ensured that basic audit policies do not overwrite these events.
I have then added the user to audit, into the SACL via the 'Auditing' tab of the specified folder, on the client workstation.
I ran a gpupdate /force, and then ran auditpol.exe /get /category:*
on the client computer, which successfully reported that auditing for success and failure had been configured for 'Object Access'. Defined policy settings working - great.
I then ran auditpol.exe /get /user:<mydomain>\specifieduser /category:"Object Access",
which reported "No audit policy is defined for the user account".
Is there a reason why this isn't being confirmed, despite the specified user being the only user in the SACL for audited folder? I'm running out of things to check, would really appreciate some help!
Many thanks.

Hi,
The audit policy settings set via group policy are per computer but not per user. Based on the description, the audit policy settings should have been applied successfully, and we can double confirm this by check the Security logs in Event Viewer to see
if corresponding events are logged when we use the account to access the folder.
In addition, per-user auditing can be configured only from the command line.
Regarding configuring Per-User auditing, the following article can be referred to for more information.
Configuring Per-User Auditing
http://windowsitpro.com/systems-management/configuring-user-auditing
Please Note: Since the website above is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Similar Messages

Easier Said Than Done

I can certainly appreciate all the recommendations here for which graphics cards to use with my G5 and a 30" monitor, but as I sit here staring at pixels the size of my thumb, the one thing constantly ignored is the fact none of these cards are actually available from reputable sources. I am two plus weeks into this and no closer to a viable solution than the day I plugged the monitor in to my absolute horror. Somebody please prove me wrong, and at the same time save me from getting financially scalped by the jacked up prices on old (yet compatible) cards. shannon

And while I'm guessing that you don't consider eBay to be a "reputable" source, you may want to reconsider. With even the most minor amount of research (ie feedback ratings), you should be able to determine if the seller is legit, if you find a good price on the card you want.
Many run stores through eBay and have solid return and refund policies in place, and PayPal (if you use it) also protects your purchase.
Just one example:
http://cgi.ebay.com/Apple-nVidia-GeForce-6800-GT-DDL-256MB-for-PowerMac_W0QQitem Z220060278571QQihZ012QQcategoryZ25449QQssPageNameZWDVWQQrdZ1QQcmdZViewItem
Search for yourself, you may be surprised.
Good luck,
K

I have had audition for 2 years. Today it crashed. It gave a configuration error: 16 The message said to uninstall and reinstall. I did. Still the same error. Then I searched forum and checked the two folder permissions. They were correct. So what

I have had audition for 2 years. Today it crashed. It gave a configuration error: 16 The message said to uninstall and reinstall. I did. Still the same error. Then I searched forum and checked the two folder permissions. They were correct. So what do I do???????

Hi Charles,
Please refer the following helps article on the problem.
https://helpx.adobe.com/x-productkb/policy-pricing/configuration-error-cs5.html
Hope this helps.
Regards,
Sumit Singh

I need more than simple 3D for a video .....

Hi guys,
What else can we use, if simple 3D / perspective is not enough ?
I am in need of squeezing one end of a video so that it looks like you are viewing the video at an angle. Like a perspective view, if you know what I mean. Simple "tilt" doesn't do it, and I don't see any of the advanced perspective features anywhere, that photoshop has available.
thanks for your help,
Dave.

Use After Effects for doing special effects like that.
Cheers
Eddie
PremiereProPedia (
RSS feed)
- Over 300 frequently answered questions
- Over 250 free tutorials
- Maintained by editors like
you
Forum FAQ

Script to enable login audit for MS SQL

Hi All,
I want to know if I can edit windows registry for enabling/disabling of login audit for MS SQL.
I need this to incorporate this in a script which would enable login audit when ran.
Thanks,

create login AuditLogin with password = ‘AuditLoginPswd’
go
/*Create a very simple login trigger */
create trigger AuditLogin_Demo
/* server means instance level*/
on all server
with execute as self
/* We specify the logon event at this stage
– If there are more than one connections,
– Issue a rollback*/
for logon
as begin
IF ORIGINAL_LOGIN()= ‘AuditLogin’ AND
(SELECT COUNT(*) FROM sys.dm_exec_sessions
WHERE is_user_process = 1 AND
original_login_name = ‘AuditLogin’) > 1
ROLLBACK;
end
go
Best Regards,Uri Dimant SQL Server MVP,
http://sqlblog.com/blogs/uri_dimant/
MS SQL optimization: MS SQL Development and Optimization
MS SQL Consulting:
Large scale of database and data cleansing
Remote DBA Services:
Improves MS SQL Database Performance
SQL Server Integration Services:
Business Intelligence

How best use the four internal disks for user folder?

Hi everyone
With the addition of a new boot disk in the second optical bay i wish to restructure my user folder. It has so far lived on one drive which i have backed up every day to one of the other internals (i also have external backups). One reason i have installed a new boot disk in the optical bay is that i have run out of space on the user folder drive (and its backup drive).
I am now wondering how i should set up the four internals if i want to use all of them for the user folder and an internal backup. Performance is an important consideration for me.
I know raid setups are not backups but given that i also have external backup could i use, for instance, raid 1 or 1+0 to mimic the current two-disk setup? Which would be preferable and are there other alternative (such as having some subfolders of the user folder, like photos and documents, on one disk and the rest of the subfolders on another disk)?
Thanks for your help
/p

I said forget those fancy software 0+1 or 10; they aren't supported, have high overhead, and you need 4 drives of same and would still not have enough space. Why bring it up again, it's still no in my book and from trouble it can be.
I'm not even a fan of Apple mirror arrays. they are fine for where 24/7 and live audio recording and to protect from the rare drive failure is all. And then I use SoftRAID.com ($149).
Full to me means less than 20% free. Though I tend to keep drives closer to 35-40% free. Less than 10-15% or less than 10-20GB can be hazardous.
Don't put scratch on boot drive. Get more RAM, have another drive or two for scratch if necessary unless it doesn't impact you. It should though. Spotlight can get in the way, needs to be disabled so having a dedicated volume on another drive has always worked best.

Save metadata for specific folder

I want to know if the metadata for each FOLDER I add can be stored separate from all the metadata file, so I could delete just a folder for later recuperate it individually and have it´s metadata???
Thanks for all your help

Metadata is not associated with folders.
Metadata is associated with photos. All metadata in Lightroom is stored in the Lightroom catalog (and there is no option to turn this off). Optionally, SOME (but not all) metadata can be stored in the photo itself (or in sidecar file in the case of RAW photos)
so I could delete just a folder for later recuperate it individually and have it´s metadata???
If you are planning to remove photos from Lightroom and then return them to Lightroom at some later point, then I would advise you to abandon this plan. Just leave the photos in Lightroom. Why? Because as I said, you could optionally store SOME (but not all) metadata with the photos, and so it is possible that some of the metadata is lost in this process (specifically, collections, edit history, pick flags, virtual copies, stacks and a few other things would be lost in this process). I also would advise you not to remove photos from Lightroom and restore them at a later time because it is more work than just leaving the photos in Lightroom, and prone to human errors.

Auditing File and Folder Access Denied Attempts

The company I work for wants to be able to review audit logs to see where people have failed to gain access to particular folders or files on a server, that is part of a DFS. I have enabled Auditing Object Access with Failures, and I have added the Everyone
group to Auditing on the folder, in which it audits all failures. However, when I review the Security Log to see those failed attempts to access a file, for example, I get a log of a success to the user who attempted to open the file, when in actuality, he
failed to open the file because he did not have rights to open it.
What am I doing wrong, or is this how Microsoft has auditing setup?

Yes, myself and a nother technician have been unable to get this to work in a test environment or the real environment. We've created new users with nothing more than Domain User membership, and only list rights to the folder, which is how the real production
folder is setup. We still do not get failure notices when the attempt to access a file they don't have rights to access.
It does however, tell them on the client end that they have been denied access. It just doesn't show in the log.

Trashed my Search For (Today) Folder:

I accidentally trashed my (ToDay) Folder: It was directly above my (Yesterday). Can anyone help me get it back? I Kinda sorta like it.
There is a snap shot
Here >>http://img.photobucket.com/albums/v189/cedarbird6/Computers/searchforo2.gif
showing where and what I’m talking about
Thanks

Thank you very much Neil for such a fast reply. I knew it had to be something simple as it was so easy to delete.
I could not find any help from the help menu .
Saepius Exertus

My $20 to the person who can write this simple script for Fission

Here is what I need to automate. I don't care if it's an Apple Script, or an Automator work flow - whatever - just so it will work with my present setup. Once I test it and it works, I'll send $20 to the first person who can help me.
Script needs to apply to each (and every) MP3 file in a selected folder:
Open the first file with Fission v1.6.6 (from: www.rogueamoeba.com)
Select all
Normalize
Save audio (in same folder)
A warning dialog pops up: "File already exists..." -- answer with "Replace"
Close file
Repeat for next file in the folder, until every file has been Normalized
End script when the last file in folder has been Normalized
I don't mind finding the folder (which will be in my iTunes Library), and then starting the set of actions on the folder but I definitely don't want to be required to take any additional action on each and every file.
I'm presently running Fission v1.6.6 under MacOS 10.4.11 on a PPC desktop, so it needs to work in that environment.
Note that the latest version of Fission requires MacOS 10.5 - I can't use any script that requires that version. Rogue Amoeba's Legacy software page (http://www.rogueamoeba.com/legacy/) shows Fission v1.6.8 as working with 10.4, but that contradicts the Version History for Fission which shows 1.6.6 as the last one for 10.4 - still investigating.

Pierre L.
Thanks for the effort!
First, I can clarify this: Rogue Amoeba confirms that I can use the version 1.6.8 of Fission located on their Legacy page with my OS version 10.4.11, so I've upgraded from 1.6.6 to 1.6.8. Seems to be working OK.
Next, let me apologize for being mostly ignorant about all things AppleScript. I'm really in over my head, here, because I've not used the ScriptEditor for more than a few minutes before today.
What I've done so far:
I checked the box in the Universal Access preferences pane to enable access for assistive devices.
I copied your script from this forum and pasted it into Script Editor.
I've Compiled your script, then "Saved As" an "Application" on my Desktop.
When I double click the icon for the saved script (which ends in xyz.app), a navigation window appears, which I used to select a test folder on my desktop.
When I Choose the test folder, Fission launched, and selected the whole file, as expected. Then I get an error:
"NSReceiverEvaluationScriptError: 4" - with buttons to "Edit" or "OK"
Thinking it might be a timing error, I edited the delays:
set theFolder to choose folder
tell application "Fission" to activate
tell application "Finder"
set theApp to POSIX path of (get file of process "Fission")
set theFiles to document files of theFolder
repeat with thisFile in theFiles
open thisFile using POSIX file theApp
tell application "System Events" to tell process "Fission"
delay 18 -- adjust if necessary
keystroke "a" using command down -- Select All
delay 2 -- adjust if necessary
click menu item "Normalize Selection" of menu 1 of menu bar item 7 of menu bar 1
delay 4 -- adjust if necessary
keystroke "s" using {shift down, command down} -- Save Audio…
delay 3 -- adjust if necessary
keystroke return -- Save
delay 2 -- adjust if necessary
click button "Replace" of sheet 1 of window "Save Audio"
end tell
end repeat
end tell
tell application "Fission" to quit -- optional
... Compiled, and Saved again.
Now, the script runs up to the point where it should answer the Save pop-up window: "File already exists..." with the keystroke to "Replace" - but the script stops there, with the same error: "NSReceiverEvaluationScriptError: 4"
Bottom line: so far, I've been able to get the first mp3 file in my test folder Normalized, but not Saved. Any suggestions?

Can anyone give me simple instructions on how to use more than one ipod on the same computer with itunes? Both my daughters have ipods, my wife has one

Dear All
Can anyone give me simple instructions on how to use more than one ipod on the same computer with itunes. My daughters have a different generation 'nano' each & my wife a 'shuffle'?
Many thanks

Click here for options.
(69081)

I need a simple Converter for a selectBooleanCheckbox.

Hi,
Can someone tell me how to build a simple converter to go from a selectBooleanCheckbox value to a String and back.
I save a String ("Y" or "N") in my table but the checkbox returns a boolean. I need a Converter to do the conversion from TRUE to "Y" and FALSE to "N". Should be easy to do but as of now, mine won't even execute properly.
I get a
javax.servlet.ServletException: javax.servlet.jsp.JspException: Can't instantiate class: 'ca.sshrc.web.common.converters.BooleanConverterYn'.
I don't understand how getAsObject and getAsString work I guess.
Thanks

Hi,
Has anyone been able to make the converter for "<h:selectBooleanCheckBox>" work??
seems like the converter method itself is not getting invoked.
this is what i am trying to do..
Code in jsp is
<h:selectBooleanCheckbox id="testCheckBox" value="#{myBean.testCheckBox}" >
     <f:converter converterId="booleanConverter" />
</h:selectBooleanCheckbox>entry in faces-config is
<converter>
       <converter-id>booleanConverter</converter-id>                  <converter-class>package.MyBooleanConverter</converter-class>
</converter>class MyBooleanConverter looks like this at the moment
public class MyBooleanConverter implements Converter {
     public Object getAsObject(FacesContext context, UIComponent component, String value) {
          myBooleanClass myBoolean = new myBooleanClass(value);
          return myBoolean;
     public String getAsString(FacesContext context, UIComponent component, Object value) {
          return value.toString();
}     Have kept myBooleanClass as a simple wrapper for the Boolean class.
Same is working for string and integer but not in this case..
Am i going wrong somewhere... kindly help

Need a fix for the 'folder last opened date'

I have been using Hazel [from www.noodlesoft.com] to set the colours of recently opened or modified files to make them easier to spot.
Within Hazel, I have set rules to monitor files contained in a named folder (and sub-folders contained therein) so I can visually spot what I have recently been working on. The rules achieve this by setting the label colours of:
• files worked on in the last 2 days to 'Green'
• unless already set to 'Green', files worked on in the last 7 days to 'Blue'
• unless already set to 'Green' or 'Blue', files worked on in the last 14 days to 'Purple'
• remove label colours for all files labelled 'Purple', 'Green' or 'Blue' that were last worked on over 14 days ago
Hazels works very well and achieves the effect I am after for files contained in that folder and its sub-folders. No problems there.
The problem I have is in defining a similar scheme of rules to apply to FOLDERS using a rule in Hazel to set the colour of a folder (or sub-folder) by reference to the date on which a folder was last opened.
For some reason, Finder does NOT update the last opened date for a folder. In fact, I have discovered (by painstakingly getting information a folder at a time) that a number of folders have date anomalies like the example below:
Date created: 4 Sep 2006
Modified date: today [which is correct as I deleted a file from in this folder]
Date opened: 31 Oct 2006 [which ignores that fact I had to open the folder today to delete the file...]
Any ideas on what could be going wrong here? Or more to the point, how I can fix this? I have run Disk Utility and using Onyx, ensured all three maintenance scripts have been run.
Any thoughts?
iMac G5 Mac OS X (10.4.8)

I am going to have to abandon Firefox and go back to IE. The fact that there has been no response is extremely disheartening. I am quite sure there is some malware involved and don't want to risk ID theft. This kind of problem should be the #1 concern for a browser company. I have regrets because I like Firefox otherwise and think it superior to the other browsers on the market including IE. C'est la vie.

Workflow on Email shoot for Un-Attended Lead more than 24 hours in MS Dynamics CRM 2011?

I want to create Workflow for Un-Attended Lead more than 24 hours then Email will shoot Automatically to User as {BM(BranchManager)}
My Business Unit Hierarchy is :
Main Organisation >> RBH Trading(Head) >> BM Trading(Branch Manager) >> RM Trading(Relational Manager)
So, if any RM will not attend his Lead until 24 hours then 1 Auto Email should send to his BM.
Actually the Problem is how to set BM Email into Email Template's "To" Field and i cannot fix any 1 BM there.
PLEASE HELP!

MatejLach wrote:
clamd is running, user and group clamav all have the relevant permissions as far as I can tell, however upon scanning my mail, I always end up with the following error:
Scanning error:
/home/username/.claws-mail/mimetmp/0000000e.mimetmp: lstat() failed: Permission denied. ERROR
Seems like a permissions error to me... maybe check the actual file it is attempting to scan... I know it is in your home folder, but just to be sure, you might want to check that everything is sane.

Maximum number of events per audit log file must be greater than 0.

BOE-XI (R2)
Windows Server 2003
Running AUDIT features on all services.
Report Application Server (RAS) keeps giving the following error in the Windows Application Event Log.
Maximum number of events per audit log file must be greater than 0. Defaulting to 500.
I am assuming that this is because the RAS is not being used by anyone at this time - and there is nothing in the local-audit-log to be copied to the AUDIT database.
Is there any way to suppress this error...?
Thanks in advance for the advice!

A couple more reboots after applying service pack 3 seemed to fix the issue.
Also had to go to IIS and set the BusinessObjects and CrystalEnterprise11 web sites to use ASP .NET 1.1 instead of 2.

Simple auditing for a folder - easier said than done!

Similar Messages

Maybe you are looking for