Scribd
Upload
6 views

File Server Auditing Quick Reference Guide

Uploaded by

Juan Carlos Cortes
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
6 views

File Server Auditing Quick Reference Guide

Uploaded by

Juan Carlos Cortes
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

Quick Reference Guide

File Server Auditing


How to enable logging of important changes to files on a File Server in security event log

File Shares Audit Settings


 Navigate to the required file share, right-click it and select “Properties”
 Select the “Security” tab > “Advanced” button > “Auditing” tab > Click “Add” button
 Select Principal: “Everyone”; Select “Type: All”; Select “Applies to: This folder, subfolders and files”; Select the
following “Advanced Permissions”: List folder / read data; Create files / write data; Create folders / append data;
Write attributes; Write extended attributes; Delete subfolders and files; Delete; Change permissions; Take
ownership
 Click “OK” three times

Audit Object Access Policy


 Run gpedit.msc > Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local
Policies > Audit Policy > Audit object access > Define > Success and Failures

Granular Audit Policy (Windows Server 2008 - 12)


Event ID Reference
(2003/2008-2012)
 Run gpedit.msc > Local Computer Policy > Computer Configuration >
Windows Settings > Security Settings > Advanced Audit Policy
 560/4656 – A handle to an object
was requested
Configuration > System Audit Policies > Object Access:
 567/4663 – Object access attempt
 Audit File System > Define > Success and Failures  4670 – Permissions to an object
 Audit Handle Manipulation > Define > Success and Failures were changed
 564/4660 – An object was deleted
Security Event Log Settings
 Run eventvwr.msc > Windows Logs > Right-click “Security” log >
Properties: Set retention method to “Overwrite events as needed” or
“Archive the log when full”
 Open Event viewer and search Security log for event id’s listed in the
Event ID Reference box
Try File Server
 To specify the action taken to the file, search for Accesses string in each
event Auditing for Free:
netwrix.com/go/trial-fs
For Detailed File Server Auditing,
Try Netwrix Auditor — netwrix.com/go/trial-fs
 Change auditing: detection, reporting and alerting on all configuration changes across your entire IT
infrastructure with Who, What, When, Where details and Before/After values.

 Predefined reports and dashboards with filtering, grouping, sorting, export (PDF, XLS etc.), email
subscriptions, drill-down, access via web, granular permissions and ability to create custom reports.

 AuditArchive™: scalable two-tiered storage (file-based + SQL database) holding consolidated audit data for 10
years or more.

 Unified platform to audit the entire IT infrastructure, unlik e other vendors with a set of hard-to-integrate
standalone tools

Corporate Headquarters: Phone: 1-949-407-5125 Int'l: 1-949-407-5125


20 Pacifica, Suite 625, Irvine, CA 92618 Toll-free: 888-638-9749 EMEA: 44 (0) 203-318-0261 netwrix.com/social

You might also like