Hello,

We have an old Windows 2003 std server and someone keeps changing the permissions on a single file that is very important, can I audit who does this?

Thanks

• Edited by TB303 15 hours 39 minutes ago

Hi
Firstly, please enable audit object access policy under Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy in Local Group Policy Editor (if it is in a domain, please check it under the default domain policy in Group Policy Manager) to a Security setting of Success.
Then you need to enable auditing on that file. Please open the file's properties dialog box, select the Security tab, click Advanced, and select the Auditing tab of the Advanced Security Settings window. In your case, you can check the Change permissions permission in the "Auditing Entry for ..." page.

After that, you can check the security logs in event viewer once some changes the permissions on that file.

Best regards,

Susie

First, you need to enable object access auditing. Please checkout the given below links to audit access and modification for the object.

https://technet.microsoft.com/en-in/library/cc776774%28v=ws.10%29.aspx
https://gallery.technet.microsoft.com/How-to-enable-File-and-af674be4

Alternatively,  you can take a look at this file access auditing ( http://www.lepide.com/file-server-audit/) tool that assist to track, audit, report and get instant alerts on all unauthorized access to files and folders on Windows servers.

• Edited by JamesRL 1 hour 13 minutes ago