Object Auditing (Server 2003)

[JoeF1]

Hi guys,

Looking for a quick bit of info if possible please.

So we have a file that is shared to quite a few people and someone keeps deleting/renaming the file so the share fails on some machines.

I have looked into Object auditing and have set it up so it tells me when people open, delete etc.

Is their an easier way of looking through the events? All im seeing is IDs so im having to go through loads of events which is time consuming? as mixed in with users names (who im auditing) there is system events etc. I'm thinking freeware 3rd party software or something with a GUI?

P.S Is Create Folders / Append data the correct box to tick to follow renames?

Cheers

 

[craig_t]

You could use logparser to filter the log for them events? I'm on the train so can't get onto my 2003 servers but there is an easier way than going through all the logs. You could also just use a filter on the event log.

I'll try get you some more details later when I am home but that may help you for now. I think from total memory it is something like a 561 event for OA success on a file. But you then have to look at the access mask to see what action was taken on that.

In the end you'll have a logparser query to filter security log for event ID 561 and access mask 0x00b3 or something along them lines.