Audit When a Share is Created

  • Thread starter Thread starter Guest
  • Start date Start date
You could enable audit of Set Key Value in the registry on the key
HKLM/System/CurrentControlSet/Services/Lanmanserver/Shares
 
What do I need to do?

Roger Abell said:
You could enable audit of Set Key Value in the registry on the key
HKLM/System/CurrentControlSet/Services/Lanmanserver/Shares
Click to expand...
 
How do I do that?

Roger Abell said:
You could enable audit of Set Key Value in the registry on the key
HKLM/System/CurrentControlSet/Services/Lanmanserver/Shares
Click to expand...
 
If the effective policy on the machine, in the Audit Policy section has
set Audit Object Access on for success, then just use regedit to find
the key and right click into its properties, where in the
security/permissions
tab you will find an Advanced button that will let you get at the Audit tab.
There you would just set Audit for Everyone for Set Key Value.
 
I set the auditing for the Shares folder. But it does not do what I want,
which is to only log when a new entry is made. Even if you were to just
click on the folder, scan the registry for viruses, or backup the registry,
it gets logged that a new share was created. I am also trying to log what
folder was shared and the new share name.
 
You have apparently set it to log all accesses to the reg key
rather than only for Set Value
 
Back
Top