Mombu the Microsoft Forum

Mombu the Microsoft Forum > Microsoft > Windows 2000 Server (TECHNET) > How to understand file audit output
REGISTER NOW! Mark Forums Read




Reply
 
Thread Tools Display Modes
1 28th September 19:16
jan larsson
External User
 
Posts: 1
Default How to understand file audit output



I have audit on a Windows 2000 TS filesystem on a public file share, i'd like
to see if a user delete or modify a file. How do I read the security log?

In security log Event ID: 560 contain the information, but is hard to
understand.
Is there an easy way to understand from this log if the user has
open/delete/ or modify the file??

Regards,
Jan

Example:
--------------------------------
Object Open:
Object Server: Security
Object Type: File
Object Name: E:\gemensam\backuplogs\backup09.log
Handle ID: 928
Operation ID: {0,667228}
Process ID: 8
Image File Name: Server1$
Primary User Name: MyDomain
Primary Domain: (0x0,0x3E7)
Primary Logon ID: John
Client User Name: MyDomain
Client Domain: (0x0,0x56079)
Client Logon ID: DELETE
READ_CONTROL
SYNCHRONIZE
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
WriteEA
ReadAttributes
WriteAttributes

Accesses: -
Privileges: %16
Restricted Sid Count: %17
  Reply With Quote
SPONSORED LINKS BY GOOGLE

 


2 28th September 19:16
meinolf weber
External User
 
Posts: 1
Default How to understand file audit output



Hello Jan,

Scroll down to Figure 2 in:
http://www.microsoft.com/technet/arc....mspx?mfr=true

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
  Reply With Quote
SPONSORED LINKS BY GOOGLE

 


Reply


Thread Tools
Display Modes







Copyright © 2006 SmartyDevil.com - Dies Mies Jeschet Boenedoesef Douvema Enitemaus -
Also visit Ogoun the Usenet Archive
666