Hi everyone,
I'm running a w2k3 and I need to audit success on files on a specific folder ... I activated auditing for the everyone group on this folder, and started to watch my logs ...
I want to know exactly what user are doing with this files ( if they are opening, or working )... After some researches, it seems that 2k3 cant tell exactly what people are doing ... but 2K8 can ...
I understand how the 560 Event ID works. Dont seem to be very accurate ... here are my doubts !
Can you tell me if I'm right or not ?!
I check the handle ID too... but it seems to be linked with the application that opens a file ... or not ... or randomly generated .. couldn't find any answer for this question of mine !
Well, that's it !
thanks all !
I'm running a w2k3 and I need to audit success on files on a specific folder ... I activated auditing for the everyone group on this folder, and started to watch my logs ...
I want to know exactly what user are doing with this files ( if they are opening, or working )... After some researches, it seems that 2k3 cant tell exactly what people are doing ... but 2K8 can ...
I understand how the 560 Event ID works. Dont seem to be very accurate ... here are my doubts !
Can you tell me if I'm right or not ?!
I check the handle ID too... but it seems to be linked with the application that opens a file ... or not ... or randomly generated .. couldn't find any answer for this question of mine !
Well, that's it !
thanks all !