Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


:)
2885 posts

Uber Geek
+1 received by user: 90

Subscriber

Topic # 230759 12-Mar-2018 11:40
One person supports this post
Send private message

I am embarking on a journey to monitor certain critical files within our environment.
Windows event logging appears to give me information when someone uses certain rights against files when auditing in enabled, so from that perspective, Check! 

 

The problem I am running into is that when you create a file, a 4663 event is not generated - for some reason it's not being seen as a "write" access. I can use 4663 to monitor Modify/Write access to an EXISTING file and delete actions against a file, but I can't seem to get this last piece of the puzzle.

 

There seems to be a lot of mixed information out, some have said 4656 events, but those are requests against an object, and not necessarily the action taken against the file from what I've read.

 

 

 

Anyone else run into this? Is there a way to track this info accurately with event logging?






Create new topic


:)
2885 posts

Uber Geek
+1 received by user: 90

Subscriber

  Reply # 1977106 15-Mar-2018 12:43
Send private message

I'm surprised to see there are no answers or suggestions here.

 

 

 

I'm going to follow up with Microsoft directly and see what they come back with. The more I dig, the more I don't think there's a straight forward answer.






354 posts

Ultimate Geek
+1 received by user: 18


  Reply # 1977165 15-Mar-2018 13:25
Send private message

I use https://www.lepide.com/lepideauditor/file-server-auditing.html to monitor file servers. If I remember correctly event logs don't record enough events to be useful.

 

 


Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.