|
8.2.4 Auditing Object Access
In Windows Server 2003, objects include Registry keys, printers, computers, files and folders. Each object
has a security information object, which is called the security descriptor, attached to it. The security
descriptor contains information about the groups or users that can access an object, and the types of access,
i.e., the permissions, granted to those groups or users. This part of the security descriptor is called the
Discretionary Access Control List (DACL). In other words, the DACL is the part of the security descriptor
that grants or denies access to the object to groups or users.
The security descriptor also contains the auditing information for the object. This part of the descriptor is
called the System Access Control List (SACL). The SACL describes the auditing activity on a group basis.
You can specify the audit permissions for objects that are in the inheritance tree using the SACL. This
enables all child objects to inherit the audit policy from their parent objects.
• Click on the
START
button
• Point to
PROGRAMS
• Point to
ACCESSORIES
• Open
WINDOWS EXPLORER
• Browse to the File or Folder you want to audit
• Right-click the File or Folder
• Click
PROPERTIES
on the popup menu
• Click on the
SECURITY
tab
• Click on
ADVANCED
• Click on the
AUDITING
tab
• Click
ADD
• Select the Users or User Groups for whom you want to audit file and folder access
• Click
OK
• Select the
SUCCESSFUL
check box and/or the
FAILED
check box for the events that you
want to audit
• Click
OK
in the appropriate dialog boxes to exit
Note: Any auditing changes that you make to a parent folder are applied to all
child folders and all files in the parent and child folders. To prevent changes
that are made to a parent folder from applying to the currently selected file
or folder, clear the Allow Inheritable Auditing Entries From Parent To
Propagate To This Object check box.
|