Auditing Mapped Drives

  • Thread starter Thread starter kzawada
  • Start date Start date
K

kzawada

Can anyone tell me how to Audit a mapped drive. I need to
be able to tell when files are deleted from that drive as
well as if subfolders or folders were move by any users in
the entire domain. After that How would I view it. Would
it be in the Security Event Log located in the management
console.
 
W wolnej burzy wypowiedzi przedstawionej w
:[email protected],
kzawada said:
Can anyone tell me how to Audit a mapped drive. I need to
be able to tell when files are deleted from that drive as
well as if subfolders or folders were move by any users in
the entire domain. After that How would I view it. Would
it be in the Security Event Log located in the management
console.
Click to expand...

Ye bu You have to audit this events on server which shares this drives -
turn on object access auditing through Local Security Polices for example,
thne go to the shared folder on NTFS volume, right click on it, properties,
security, advanced, auditing - set needed audit entries.

Logs are written to security log


--
Tomasz Onyszko, MCSE - (e-mail address removed)
http://www.w2k.pl/
Poland



Serwis Usenet w portalu Gazeta.pl -> http://www.gazeta.pl/usenet/
 
Enable auditing on the folder that the mapped drive points to and you will
see the events in the security log of the server that the share resides on.
Make sure that "audit files and folders" has been enabled in the group
policy. The steps to do this can be found at 300549 HOW TO: Enable and
Apply Security Auditing in Windows 2000
http://support.microsoft.com/?id=300549 .

--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Back
Top