If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Viewing audit information in XP - nothing appearing in the event viewer
I have enabled auditing on a folder and its files and subfolders for
my user name and for SYSTEM. I believe I have set this up correctly and I have enabled audit for all access for success and failure. However when I go into event viewer I cannot see any new messages about what's happened. I have opened a file within the folder and saved it and still don't see any new messages. Is there something that I need to do to activate it or perhaps I've set it up wrong. Any help will be much appreciated. Thanks, Darren. |
Ads |
#2
|
|||
|
|||
Viewing audit information in XP - nothing appearing in the event viewer
Explain how exactly did you "enable auditing on a folder and its files".
If we knew exactly how you did it step-by-step, we could better determine what went wrong. "Darren" wrote in message om... I have enabled auditing on a folder and its files and subfolders for my user name and for SYSTEM. I believe I have set this up correctly and I have enabled audit for all access for success and failure. However when I go into event viewer I cannot see any new messages about what's happened. I have opened a file within the folder and saved it and still don't see any new messages. Is there something that I need to do to activate it or perhaps I've set it up wrong. Any help will be much appreciated. Thanks, Darren. |
#3
|
|||
|
|||
Viewing audit information in XP - nothing appearing in the event viewer
"JW" wrote in message ...
Explain how exactly did you "enable auditing on a folder and its files". If we knew exactly how you did it step-by-step, we could better determine what went wrong. OK. 1. In Windows explorer right click on the folder that I want to audit and select Properties. 2. Select Security tab. 3. Click Advanced button. 4. Select Auditing tab. 5. Click Add button. 6. Entered WINXPOFFICE\Darren as the object name and clicked 'check name' button and then clicked OK. 7. Ticked the full control for Successful & Failed so that all checkboxes are ticked. 8. Clicked OK button. 9. Repeated steps 5-8 and entered SYSTEM as the object name. 10. Clicked 'replace auditing entries on all child objects with entries shown here that apply to child objects' checkbox. 11. Clicked OK. 12. Clicked OK to leave the properties. Did I miss anything when trying to set up auditing on my files and folders? Thanks, Darren. |
#4
|
|||
|
|||
Viewing audit information in XP - nothing appearing in the event viewer
An exact step-by-step explanation is all we needed to find the problem.
You completed Part 1 just fine. Now it's time to complete Part 2. Now go run Local Security Policy (under Admin Tools in Control Panel). In the left pane, click on Audit Policy. In the right pane, change "No Auditing" to the value you want (Success and/or Failure). You have to be logged into an account in the Administrator's group to do this. "Darren" wrote in message m... "JW" wrote in message ... Explain how exactly did you "enable auditing on a folder and its files". If we knew exactly how you did it step-by-step, we could better determine what went wrong. OK. 1. In Windows explorer right click on the folder that I want to audit and select Properties. 2. Select Security tab. 3. Click Advanced button. 4. Select Auditing tab. 5. Click Add button. 6. Entered WINXPOFFICE\Darren as the object name and clicked 'check name' button and then clicked OK. 7. Ticked the full control for Successful & Failed so that all checkboxes are ticked. 8. Clicked OK button. 9. Repeated steps 5-8 and entered SYSTEM as the object name. 10. Clicked 'replace auditing entries on all child objects with entries shown here that apply to child objects' checkbox. 11. Clicked OK. 12. Clicked OK to leave the properties. Did I miss anything when trying to set up auditing on my files and folders? Thanks, Darren. |
#5
|
|||
|
|||
Viewing audit information in XP - nothing appearing in the event viewer
Thanks JW.
"JW" wrote in message ... An exact step-by-step explanation is all we needed to find the problem. You completed Part 1 just fine. Now it's time to complete Part 2. Now go run Local Security Policy (under Admin Tools in Control Panel). In the left pane, click on Audit Policy. In the right pane, change "No Auditing" to the value you want (Success and/or Failure). You have to be logged into an account in the Administrator's group to do this. |
#6
|
|||
|
|||
Viewing audit information in XP - nothing appearing in the event viewer
Is nice to see a Thanks.
Glad I could help. "Darren" wrote in message om... Thanks JW. "JW" wrote in message ... An exact step-by-step explanation is all we needed to find the problem. You completed Part 1 just fine. Now it's time to complete Part 2. Now go run Local Security Policy (under Admin Tools in Control Panel). In the left pane, click on Audit Policy. In the right pane, change "No Auditing" to the value you want (Success and/or Failure). You have to be logged into an account in the Administrator's group to do this. |
Thread Tools | |
Display Modes | |
|
|