Windows 2003 auditing folders

For example, you want to determine the use of either printers or files, or verify the use of unauthorized resources. By default, auditing is turned off. For domain controllers, an audit policy setting is configured for all domain controllers in the domain. To audit events that occur on domain controllers, configure an audit policy setting that applies to all domain controllers in a non-local Group Policy object GPO for the domain.

You can access this policy setting through the Domain Controllers organizational unit. To audit user access to Active Directory objects, configure the Audit Directory Service Access event category in the audit policy setting. Select Define These Policy Settings , and then select one or both of the following check boxes:. Right-click any other event category that you want to audit, and then select Properties. The changes that you make to your computer's audit policy setting take effect only when the policy setting is propagated or applied to your computer.

Complete either of the following steps to initiate policy propagation:. If you are either a domain or an enterprise administrator, you can enable security auditing for workstations, member servers, and domain controllers remotely. After you configure an audit policy setting, you can configure auditing for specific objects, such as users, computers, organizational units, or groups, by specifying both the types of access and the users whose access that you want to audit.

To configure auditing for specific Active Directory objects:. Right-click the Active Directory object that you want to audit, and then select Properties. The best answers are voted up and rise to the top. Stack Overflow for Teams — Collaborate and share knowledge with a private group. Create a free Team What is Teams? Learn more. Setting up auditing on folder deletion Ask Question.

Asked 11 years, 4 months ago. Active 11 years, 4 months ago. Viewed 3k times. I'm sorry if the question is too easy, but I absolutely have to have this right Improve this question. Add a comment. Active Oldest Votes. Improve this answer. Grizly Grizly 2, 15 15 silver badges 20 20 bronze badges. The next time Group Policy refreshes on devices in scope of the GPO, the auditing setting you configured in the policy above will be applied. In Windows Server , event ID can indicate different types of events, including ownership of file taken, generic file read, and ACL on files modified.

Did I forget any setting? All tips welcome, Thanks,. Hi Sam! Thanks for your understanding. Your email address will not be published. Save my name, email, and website in this browser for the next time I comment. Go Up. Netwrix Blog. Type msc in the Run dialog, and click OK.