We have someone who is hiding file shares on our network. My questions are the following: What permissions do you require to hide a file share? Second, if we want to configure auditing to see who is actually changing the shares to be hidden, what selections do we need to check off under object access auditing?Thanks for your assistance!

Members from the Administrator Group can create and deletethe Hidden shares and for autditing you can read this KB article http://support.microsoft.com/kb/310399.and in case if you need to know a hidden share of a particular pc you can always run NET VIEW command from CMD.Net view \\computername this will give you all the shares on a pc.Thanks and Hope it helps Syed Khairuddin

Hi Scott, I agree with what Syed said. For auditing folder, you may also refer to: How To Set, View, Change, or Remove Auditing for a File or Folder in Windows 2000 http://support.microsoft.com/kb/301640 Apply or modify auditing policy settings for a local file or folder http://technet.microsoft.com/en-us/library/cc784387.aspx Hope it helps.David Shen - MSFT