Photo Gallery Member List Search Calendars FAQ Ticket List Log Out


Audit Disk (or folder) access

  		Logged in as: Guest
arrSession:exec spGetSession 2,2,29008
Active Users: There are 0 members and 0 guests.
Users viewing this topic: none
 

 

  
 
  Printable Version
All Forums >> [Scripting] >> WSH & Client Side VBScript >> Audit Disk (or folder) access
  Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks! 		Page: [1]
Login
Message << Older Topic   Newer Topic >>
Audit Disk (or folder) access - 12/14/2005 3:12:11 AM   
  jclore

 

Posts: 2
Score: 0
Joined: 12/14/2005
Status: offline 		Either my search-fu is weak today or there is not much out there on this.  Here is what I am trying to do:
Audit all failures by anyone to access anything on E:\   (Server2000 & Server2k3)

We have automated enabling the audit policy via importing a security template using secedit.  The second step currently involves *manually* logging into each server and right clicking on e:\, selecting properties, clicking on the security tab, clicking on advanced, clicking on auditing tab, adding the everyone group, checking the first box in the failure column (which in turn checks the rest).

I'm looking to automate this.... Has anyone tried anything similar to this.  I've done a little bit of VBScripting here and there but I'm far from an expert and just having a little trouble getting started.  Anyway, I'll keep googling but thanks in advance for any assistance.
 
 
Post #: 1
 
RE: Audit Disk (or folder) access - 12/14/2005 4:17:01 AM   
  Cybex


Posts: 412
Score: 0
Joined: 9/14/2005
From: Florida
Status: offline 		You set the auditing settings in the security template also.

Cybex

_____________________________

Common sense is not so common.

(in reply to jclore)
 
 
Post #: 2
 
RE: Audit Disk (or folder) access - 12/14/2005 4:39:40 AM   
  jclore

 

Posts: 2
Score: 0
Joined: 12/14/2005
Status: offline 		Thanks for the quick reply Cybex

I believe that I'm missing something... I know that auditing usually requires two steps. 

1) Enabling auditing in the security policy
2) Enabling auditing on the object in question

Your post implies that both can be accomplished through the security policy.  I'm not seeing anything in the local security policy that allows me to audit the E:\ of the machine(s).  I did manually confugure the auditing on the E:\ (using the method described in my initial post) and then returned to the local security policy and noticed that nothing had changed.  Oh well, I'll keep plugging away at it. Thanks Again.

(in reply to Cybex)
 
 
Post #: 3
 
RE: Audit Disk (or folder) access - 12/14/2005 6:08:58 AM   
  Cybex


Posts: 412
Score: 0
Joined: 9/14/2005
From: Florida
Status: offline 		This has nothing to due with VBScript so everyone else look away... 

Start, run, mmc, add snap in for Security and analysis, import your template.  Under File System, Right click and select properties on the drive in question and define the policy in the database, when the security options come up go to advanced and then auditing and set yourauditing rules.  Export thr template and live long and prosper.


That is the quick down and dirty sorry no screen shots.


Cybex

_____________________________

Common sense is not so common.

(in reply to jclore)
 
 
Post #: 4
 
RE: Audit Disk (or folder) access - 12/14/2005 7:39:31 AM   
  Cybex


Posts: 412
Score: 0
Joined: 9/14/2005
From: Florida
Status: offline 		Also you have to build the template on a like setup in order to see those drives and stuff.


Cybex

_____________________________

Common sense is not so common.

(in reply to Cybex)
 
 
Post #: 5
 
 
 
 

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.
All Forums >> [Scripting] >> WSH & Client Side VBScript >> Audit Disk (or folder) access Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts




Forum Software © ASPPlayground.NET Advanced Edition 2.5.5 ANSI