How to audit failure event in security log

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

My W2K DC have take all the component successl & failure in the audit setting,
and once of W2K share folder (e.g. Test) have grant all the success & failure in the folder and file perrmission for everyone user, but only success event can logged into security log, the failure event ( e.g. rename / move a file ) cannot logged into security log.
Any setting need to customized so that we can take the failure event logged into security log to check it. Pls help me to solve it.
Thanks !
 
Did you check all the event ID 560 and 562 that were listed. You probably have a ton
of them in the security log and that should be where you find file access
ntries. --- Steve

http://www.microsoft.com/technet/security/guidance/secmod144.mspx

Tinsiu said:
My W2K DC have take all the component successl & failure in the audit setting,
and once of W2K share folder (e.g. Test) have grant all the success & failure in
Click to expand...
the folder and file perrmission for everyone user, but only success event can logged
into security log, the failure event ( e.g. rename / move a file ) cannot logged into
security log.
Any setting need to customized so that we can take the failure event logged into
Click to expand...
security log to check it. Pls help me to solve it.
 
Back
Top