To keep an audit (log) of file access on a Windows file server (or shared resources), a feature of the same name is used - auditing. What does it do? It lets you record attempts - both successful and failed - to access files in the operating system's "Security" log, along with the operations performed on them, such as reading, deleting, creating, modifying, and changing attributes.
So, let's enable it.
1)
Enable audit policies.First we need to enable audit policies. To do this, open:
Administrative Tools / Local Security PolicyNext, go to the section
Local Policies / Audit Policywhere you'll see this server's set of audit policies.
You need to enable the policies you require. For example, to audit file access - you need to enable "Audit object access".
When doing so, specify which events you want to save to the log:
- Success: when a user successfully performs an action (they have the rights to do so)
- Failure: when the system denies the user permission to perform an action (no rights)
2)
Set up auditing on the required folders and filesEnabling the audit policy is only half the job. Now, in the server's own file system, you need to specify exactly which folders to log.
To do this, open the properties of the folder you need (right-click the folder and choose "Properties"), go to the "Security" tab, click "Advanced", and go to the "Auditing" tab.
Folder Properties -> Security -> Advanced -> AuditingIt's this Auditing tab you need to edit. In Windows Server 2008, unlike 2003, you also need to click the "Continue" button to make changes.
Here:
a) Click the "Add" button
b) Enter the name(s) of the user(s) or group for whom this audit entry will be active - i.e., which users' activity should trigger this audit rule. To have the rule trigger for all users - enter "Everyone".
c) Click "OK"
d) In the window that opens, select which events should trigger this rule. You can specify separately - for successful events ("Success") and for events where the user is denied the action ("Failure").
e) It's advisable to check "Replace all existing inheritable auditing entries..." if you want events recorded for all files and folders inside the selected one. Just to be safe - in case an audit rule override exists somewhere.
f) That's it, save and exit.
Repeat the procedure for every folder that needs an access log.
3)
ViewingYou can view audit events through "Event Viewer" - a Windows administrative tool - under the "Security" section.
Unfortunately, Microsoft paid no attention at all to this process, so to understand exactly what a given user did with a given file you have to look through several events at once and piece together a chain of events from them.
Here's an example of such a chain in the log:
a) User DOMAIN\user requested handle 001 for file D:\file
b) User DOMAIN\user was granted "Write, Read, Modify" rights for handle 001
c) User DOMAIN\user: deleted the file. Handle 001
d) User DOMAIN\user: requested the current state of the folder
This is very simplified. If you have hundreds of people working on the server with shared resources, events can and will interleave with those of other users, and you'll have to do some digging to pull out the information you need and reconstruct the chain of actions. But that's better than nothing at all.
Comments