Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


:)
2876 posts

Uber Geek
+1 received by user: 85

Subscriber

Topic # 230759 12-Mar-2018 11:40
One person supports this post
Send private message

I am embarking on a journey to monitor certain critical files within our environment.
Windows event logging appears to give me information when someone uses certain rights against files when auditing in enabled, so from that perspective, Check! 

 

The problem I am running into is that when you create a file, a 4663 event is not generated - for some reason it's not being seen as a "write" access. I can use 4663 to monitor Modify/Write access to an EXISTING file and delete actions against a file, but I can't seem to get this last piece of the puzzle.

 

There seems to be a lot of mixed information out, some have said 4656 events, but those are requests against an object, and not necessarily the action taken against the file from what I've read.

 

 

 

Anyone else run into this? Is there a way to track this info accurately with event logging?






Create new topic


:)
2876 posts

Uber Geek
+1 received by user: 85

Subscriber

  Reply # 1977106 15-Mar-2018 12:43
Send private message

I'm surprised to see there are no answers or suggestions here.

 

 

 

I'm going to follow up with Microsoft directly and see what they come back with. The more I dig, the more I don't think there's a straight forward answer.






348 posts

Ultimate Geek
+1 received by user: 16


  Reply # 1977165 15-Mar-2018 13:25
Send private message

I use https://www.lepide.com/lepideauditor/file-server-auditing.html to monitor file servers. If I remember correctly event logs don't record enough events to be useful.

 

 


Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Microsoft Dynamics 365 Business Central launches
Posted 10-Jul-2018 10:40


Spark completes first milestone in voice platform upgrade
Posted 10-Jul-2018 09:36


Microsoft ices heated developers
Posted 6-Jul-2018 20:16


PB Technologies charged for its extended warranties and warned for bait advertising
Posted 3-Jul-2018 15:45


Almost 20,000 people claim credits from Spark
Posted 29-Jun-2018 10:40


Cove sells NZ's first insurance policy via chatbot
Posted 25-Jun-2018 10:04


N4L helping TAKA Trust bridge the digital divide for Lower Hutt students
Posted 18-Jun-2018 13:08


Winners Announced for 2018 CIO Awards
Posted 18-Jun-2018 13:03


Logitech Rally sets new standard for USB-connected video conference cameras
Posted 18-Jun-2018 09:27


Russell Stanners steps down as Vodafone NZ CEO
Posted 12-Jun-2018 09:13


Intergen recognised as 2018 Microsoft Country Partner of the Year for New Zealand
Posted 12-Jun-2018 08:00


Finalists Announced For Microsoft NZ Partner Awards
Posted 6-Jun-2018 15:12


Vocus Group and Vodafone announce joint venture to accelerate fibre innovation
Posted 5-Jun-2018 10:52


Kogan.com to launch Kogan Mobile in New Zealand
Posted 4-Jun-2018 14:34


Enable doubles fibre broadband speeds for its most popular wholesale service in Christchurch
Posted 2-Jun-2018 20:07



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.