Please help me out form this problem.
I have configured windows auditing on some of the critical folders on our server (Windows 2003 Server), I have applied the group policy for i.e. enabled object access (both failure and success). Then I configured auditing on these folders and selected the auditing option for the following:
1. Delete
2. Delete subfolders and files
3. Change Permissions
4. Take Ownership
5. Create Files / Write Data
6. Create folders /Append Data
Ok now I have deployed the GFI Event Manager 7 for centralized logging and monitoring and I should alert in case of any above event occurs for both success and failure. But I am just getting the alerts/events for object deletion and if any user tries to access the properties of the folder I get alert "take ownership attempt for file and folder". But I am not getting any kind of information about the change permission i.e. if change any permission on that folder or create any new file or folder.
I have asked to GFI forum that why I am not getting these alerts they that GFI can only provide the alert for the events if they are in the Windows Security event log. Can any one help me that whether windows provide/generate the event i.e. for Change permission, creating new file or folder and deletion of subfolders and file??? If so what and how I can do this on Win XP as well as Win 2003 server. I am not sure might be I did not configured the GFI properly so guide me in case its not the windows issue
Sign In
Create Account
