Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

custom security log for file audit

$
0
0

Hi,

On my 2008r2 fileservers I'm willing to audit file and folder deletion.

I know that Audit Object Access has to be enabled (success and failure), but this generates a LOT of events in my security log

I can expand the logsize and not let it be overwritten, but what I'd like to do is create a custom logfile (instead of a filtered view on the security log) that only logs event ID 4663 from from Microsoft Windows Security Auditing and category File System.

or is there another way to monitor file deletions without enabling AOA ?


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>