We have Windows server 2003 and we need to keep track of specially files which are being copied and deleted from server mapped drive. We have followed the link http://support.microsoft.com/kb/814595 and have configure Group Policy and folder Security Audit. When we check Security logs it deos not show anything related to file Audit, it shows only logon and logoff event. Kindly help to figure out what we are doing wrong. Our objective is to keep track of files which are being copied and deleted on server shared drives. Regards, NzmNzm

To enable file audit, have a look to this link (It is explained with the use of pictures): http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access

To enable print audit, have a look to these links: http://technet.microsoft.com/en-us/library/cc976774.aspx http://www.windowsitpro.com/article/reporting2/how-do-i-enable-print-auditing-.aspx Your link is also intersting if you want GPOs deployment.

If you use GPOs don't forget to run gpupdate /force on the server (It is recommanded to run it also on the client computer). Make sure also that you have no problem with Active Directory replication. Best regards.

Hi, Thank you very much for your help. I have tried all the possible options mentioned above, tried gpupdate /force, but still it does not show any detail in Security Log. I am more interested in File and folder log than print log. We have come across that users have moved some folders from their orginal location to some where else and we can't trace them, that why this become very important. Please help. Regards, NzmNzm

Hi Nzm, You need to first enable the Audit object access policy setting on the computer where the specific files locate. Then apply audit policy to the specific files. After that, run gpupdate /force and check the security log on that computer. For more information, refer to: Operation-based auditing on files or folders http://technet.microsoft.com/en-us/library/cc738931(WS.10).aspx If the problem continues, please run rsop.msc on the computer where the specific files locate to check if the Audit object access policy has been applied. Regards, Bruce

Hi , I have gone through the mentioned link and have applied the settings. Have done gupdate /force also but when checked through rsop.msc in Computer Configuartion - Windows Settings - Local Policies - Audit Policy, it shows all polict as Not Defined. It does not allow me to change the setting here. What to do now, please help. Regards, Nzm Nzm

Hi, One more problem I have noticed. If I make any change in group policy and run gpupdate /force tehn when I check through rsop.msc it shows the changes, but when I make the change in Audit object access, and run gpupdate /force, then run rsop.msc, it still shows Audit object access as Not Defined. What could be teh reason for the same. Regards, NzmNzm

Hi Nzm, Thanks for your update. I understand that you have configured the Audit object access settings. However, the change does not show up in rsop.msc At this point, please let us know the following information: 1. Where does the specific files that you want to audit locate? On a domain controller or member server? 2. How did you configure the Audit object access settings? Through gpedit.msc or gpmc.msc? If you use gpmc.msc, which GPO did you edit? General speaking, you should configure the GPO for the OU which contains the computer where the files locate. Regards, Bruce

Hi Bruce, Here the answers: 1. The specific files that I want to sudit is located on my Domain Controller. 2. I have configured audit Policy using Group Policy Management. I am modifying Domain Controller Policy. When I type gpedit.msc it shows Audit object access ad Not Defined, it deos not reflect the change which I have done in group Policy. Please help. Regards, Nzm

Hi, Any reply fro this, Its urgent to resolve the problem. Regards, Nzm

Hi Nzm, Is there any other GPO linked to Domain Controllers? Did you check if other settings in Default Domain Controllers policy have been applied? Please run rsop.msc on domain controller, navigate to [Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy]. On the right pane, double click "Audit object access" -> Precedence tab. Is Default Domain Controller Policy listed as the first one? If not, you need to change the precedence. If the problem continues, open Group Policy Management console. On the left pane, right click "Group Policy Result" -> "Group Policy Results Wizard" to collect the result on this DC. On the right pane, you can check if the policy has been applied. Make sure to check the "Policy Events" tab. If there is any error, please let us know. Meanwhile, as this forum is focused on break fix issues that are neither urgent, nor complex. If the issue is urgent to your business, it is recommended that you contact Microsoft Customer Support Services (CSS) via telephone so that a dedicated Support Professional can assist you in a more efficient manner. Please be advised that contacting phone support will be a charged call. To obtain the phone numbers for specific technology request please take a look at the web site listed below. http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS If you are outside the US please see http://support.microsoft.com for regional support phone numbers. Regards, Bruce