Hello,

We have an old Windows 2003 std server and someone keeps changing the permissions on a single file that is very important, can I audit who does this?

Thanks

• Edited by TB303 Thursday, March 26, 2015 3:20 PM

First, you need to enable object access auditing. Please checkout the given below links to audit access and modification for the object.

https://technet.microsoft.com/en-in/library/cc776774%28v=ws.10%29.aspx
https://gallery.technet.microsoft.com/How-to-enable-File-and-af674be4

Alternatively,  you can take a look at this file access auditing ( http://www.lepide.com/file-server-audit/) tool that assist to track, audit, report and get instant alerts on all unauthorized access to files and folders on Windows servers.

• Edited by JamesRL Friday, March 27, 2015 5:47 AM

Yes it is a domain member server and is Windows 2003, so I need to enable first on the default domain policy?

What event code shoudl I be looking for?

Hmm I've enabled audit object access on the server for success and I'm getting 100's of event logs now which I don't want.  I did try and change the permissions on the file to see if anything showed up but I don't hink it did, but there are too many events to go through I've had to turn it off. 

Reading the logs is usually a time consuming and complex task. I would recommend using a third party tool to audit changes on your File Servers. My favorite one is Lepide Auditor - File Server: http://www.lepide.com/file-server-audit/