Audit code meaning

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi,

I have turn on auditing for event ID 560.
Would like to know what does "Accesses: SYNCHRONIZE, READ_CONTROL,
ReadAttributes, DELETE, ReadData (or ListDirectory)" means?

Would appreciate if someone can also point me the site where is state the
meaning.

Regards.
 
Apparently you enabled auditing of object access which records when a user
is accessing a file in the operating system. Generally it is best to enable
auditing of object access only if you have a specific reason to such as then
enabling auditing on folders or files for access for permissions you want to
track. You will also see object access events recorded even if there is no
auditing configured on a folder/file. Refer to the link below for the
section on object access. --- Steve

http://www.microsoft.com/technet/security/prodtech/windows2000/secmod144.mspx
 
Back
Top