Win 2008r2 Audit

Question

I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns on audit for every files/folders. I have just enabled auditing on some folders....

any ideas?

There is no Support for auditing only "some" Folders. You can handle this with a powershell script to get only the results of the Folder you want. get-help get-eventlog (Powershell cmdlet) — patricks, Mar 19 '13 at 15:15
so it's either audit is enabled for everything or nothing? Then what's the use of putting audit on folders? — Alex, Mar 19 '13 at 15:16

score 0 · Accepted Answer · answered Mar 21 '13 at 15:19

0

I jsut found out how to do that. In a prompt you need to run this command : auditpol /set /subcategory:"File System" /Success:enable

Then you can specify audit on the folders/files you want.

answered Mar 21 '13 at 15:19

Alex

131
1
11

Win 2008r2 Audit

1 Answers1