Ok you probably need to modify the auditing policy Goto administrative tools, local security policy Look under local policies/audit policy
You probably want to edit the object access policy and enable it. This will cause your secuirty event log to get very big with all these audits turned on, so make sure you set it to overwrite as neccisary and create a scheduled backup of the log, or make the max log size very large. Russ > -----Original Message----- > From: Justin MacCarthy [mailto:[EMAIL PROTECTED] > Sent: 11 June 2004 18:39 > To: [EMAIL PROTECTED] > Subject: Re: [ cf-dev ] ot windows security question > > Yeah I know where the dialogs are, problem is I can't seem > to get the accesses logged. > > If I add all auditing success/failure for the Everyone group > I should get every single access attempt successful or not , > is that correct? > Event viewer should show the user that made the access > attempt also right? > > Justin > > On Jun 11, 2004, at 6:22 PM, Snake Hollywood wrote: > > > Get the drive/folder properties. > > Goto security/advanced > > And add the auditing entries you want. > > Goto the event manage, right click get the properties of > the security > > event log, goto filters, and enable the auditing events you want to > > show. > > > > > > Russ > > > >> -----Original Message----- > >> From: Justin MacCarthy [mailto:[EMAIL PROTECTED] > >> Sent: 11 June 2004 14:01 > >> To: [EMAIL PROTECTED] > >> Subject: Re: [ cf-dev ] ot windows security question > >> > >> Sorry Windows 2000 server > >> > >> Justin > >> > >> On Jun 11, 2004, at 1:50 PM, Snake Hollywood wrote: > >> > >>> Windows server2000/2003 or windowsxp > >>> > >>> > >>>> -----Original Message----- > >>>> From: Justin MacCarthy [mailto:[EMAIL PROTECTED] > >>>> Sent: 11 June 2004 13:34 > >>>> To: cfuk > >>>> Subject: [ cf-dev ] ot windows security question > >>>> > >>>> Hi > >>>> > >>>> I have a folder containing files that are been accessed by > >> serveral > >>>> Windows users /processes. I want to audit any failed attempts to > >>>> access file within that folder. How do I go about this? > >>>> > >>>> Only 2 groups have should access to the folder. > >>>> > >>>> I can seem to the get the right combination of audits etc.. > >>>> > >>>> Thanks Justin > >>>> > >>>> > >>>> -- > >>>> These lists are syncronised with the CFDeveloper forum at > >>>> http://forum.cfdeveloper.co.uk/ > >>>> Archive: > http://www.mail-archive.com/dev%40lists.cfdeveloper.co.uk/ > >>>> > >>>> CFDeveloper Sponsors and contributors:- *Hosting and > >> support provided > >>>> by CFMXhosting.co.uk* :: > >>>> *ActivePDF provided by activepdf.com* > >>>> *Forums provided by fusetalk.com* :: *ProWorkFlow > >> provided by > >>>> proworkflow.com* > >>>> *Tutorials provided by helmguru.com* :: *Lists > >> hosted by > >>>> gradwell.com* > >>>> > >>>> To unsubscribe, e-mail: [EMAIL PROTECTED] > >>>> > >>> > >>> > >>> -- > >>> These lists are syncronised with the CFDeveloper forum at > >>> http://forum.cfdeveloper.co.uk/ > >>> Archive: > http://www.mail-archive.com/dev%40lists.cfdeveloper.co.uk/ > >>> > >>> CFDeveloper Sponsors and contributors:- *Hosting and > >> support provided > >>> by CFMXhosting.co.uk* :: *ActivePDF provided by activepdf.com* > >>> *Forums provided by fusetalk.com* :: *ProWorkFlow > provided by > >>> proworkflow.com* > >>> *Tutorials provided by helmguru.com* :: *Lists > hosted by > >>> gradwell.com* > >>> > >>> To unsubscribe, e-mail: [EMAIL PROTECTED] > >>> > >>> > >> > >> > >> -- > >> These lists are syncronised with the CFDeveloper forum at > >> http://forum.cfdeveloper.co.uk/ > >> Archive: http://www.mail-archive.com/dev%40lists.cfdeveloper.co.uk/ > >> > >> CFDeveloper Sponsors and contributors:- *Hosting and > support provided > >> by CFMXhosting.co.uk* :: > >> *ActivePDF provided by activepdf.com* > >> *Forums provided by fusetalk.com* :: *ProWorkFlow > provided by > >> proworkflow.com* > >> *Tutorials provided by helmguru.com* :: *Lists > hosted by > >> gradwell.com* > >> > >> To unsubscribe, e-mail: [EMAIL PROTECTED] > >> > > > > > > -- > > These lists are syncronised with the CFDeveloper forum at > > http://forum.cfdeveloper.co.uk/ > > Archive: http://www.mail-archive.com/dev%40lists.cfdeveloper.co.uk/ > > > > CFDeveloper Sponsors and contributors:- *Hosting and > support provided > > by CFMXhosting.co.uk* :: *ActivePDF provided by activepdf.com* > > *Forums provided by fusetalk.com* :: *ProWorkFlow provided by > > proworkflow.com* > > *Tutorials provided by helmguru.com* :: *Lists hosted by > > gradwell.com* > > > > To unsubscribe, e-mail: [EMAIL PROTECTED] > > > > > > > -- > These lists are syncronised with the CFDeveloper forum at > http://forum.cfdeveloper.co.uk/ > Archive: http://www.mail-archive.com/dev%40lists.cfdeveloper.co.uk/ > > CFDeveloper Sponsors and contributors:- > *Hosting and support provided by CFMXhosting.co.uk* :: > *ActivePDF provided by activepdf.com* > *Forums provided by fusetalk.com* :: *ProWorkFlow > provided by proworkflow.com* > *Tutorials provided by helmguru.com* :: *Lists > hosted by gradwell.com* > > To unsubscribe, e-mail: [EMAIL PROTECTED] > -- These lists are syncronised with the CFDeveloper forum at http://forum.cfdeveloper.co.uk/ Archive: http://www.mail-archive.com/dev%40lists.cfdeveloper.co.uk/ CFDeveloper Sponsors and contributors:- *Hosting and support provided by CFMXhosting.co.uk* :: *ActivePDF provided by activepdf.com* *Forums provided by fusetalk.com* :: *ProWorkFlow provided by proworkflow.com* *Tutorials provided by helmguru.com* :: *Lists hosted by gradwell.com* To unsubscribe, e-mail: [EMAIL PROTECTED]
