Auditing File Access In Windows NT/2000/XP/2003

You are here:
  • KB Home
  • A
  • Auditing File Access In Windows NT/2000/XP/2003
< Back
Auditing File Access In Windows NT/2000/XP/2003
Last Updated: 23 Sep 2005
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

*** PLEASE NOTE: Link(s), If Provided, May Be Wrapped ***


File Auditing is a feature of NT Security that allows you
to establish which user account was responsible for what
activity on your NT4 or 2000/2003 machine or domain.  By
default, no auditing is configured in NT4 or 2000, so you
will want to correct that right away.  The defaults in
Windows Server 2003 tend to emphasize a greater security
consciousness than in previous versions of Windows.


You can manage your audit policy using the following
tools:

• USRMGR ................. Native Utility
• MMC (SECPOL.MSC) ....... Native Utility (Win2K and later)
• AUDITPOL ............... Resource Kit


OTHER UTILITIES

• ACCTINFO.DLL ........... Resource Kit -- Server 2003


Windows 2000 and 2003 provide even more categories for
auditing, as compared to NT4, and the new version of
AUDITPOL in the 2000 ResKit adds several parameters.

Group policy is the preferred mechanism for setting
Auditing in 2000, XP and 2003.


NT4 AUDITING

	System    : System events
	Logon     : Logon/Logoff events
	Object    : Object access
	Privilege : Use of privileges
	Process   : Process tracking
	Policy    : Security policy changes
	Sam       : SAM changes


WIN2K AUDITING

	System    : System events
	Logon     : Logon/Logoff events
	Object    : Object access
	Privilege : Use of privileges
	Process   : Process tracking
	Policy    : Security policy changes
	Sam       : SAM changes
	Directory : Directory access
	Account   : Account logon events


CONFIGURATION

My auditing is configured as follows:

• System                    = Success and Failure
• Logon                     = Success and Failure
• Object Access             = Failure
• Privilege Use             = Failure
• Process Tracking          = Failure
• Policy Change             = Success and Failure
• Account Management        = Success and Failure
• Directory Service Access  = Success and Failure
• Account Logon             = Success and Failure


SCRIPTING SAMPLES

You can change your Auditing configuration with the
following script:

*** Requires NT4 or higher PLUS Server ResKit ***
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
auditpol %1 /ENABLE /system:ALL /logon:FAILURE /object:FAILURE /privilege:FAILURE /process:NONE /policy:ALL /sam:ALL /directory:FAILURE /account:FAILURE
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


ACCESSING AUDIT CONFIGURATION VIA GUI

• Windows 2000 and Later (excluding XP Home):
	 1. START --> RUN --> SECPOL.MSC
	 2. Expand "Local Security Settings"
	 3. Expand "Local Policies"
	 4. Select "User Rights Assignment"


3RD PARTY TOOLS

• http://www.foundstone.com/knowledge/free_tools.htmlhttp://www.pedestalsoftware.com/utilities/download_trials.asphttp://www.chambet.com/tools.htmlhttp://www.greyware.com/software/logonmon/


WHITEPAPERS & TECH DOCUMENTS

• http://www.microsoft.com/downloads/details.aspx?FamilyID=8A2643C1-0685-4D89-B655-521EA6C7B4DB&displaylang=enhttp://www.microsoft.com/downloads/details.aspx?FamilyID=2D3E25BC-F434-4CC6-A5A7-09A8A229F118&DisplayLang=enhttp://www.microsoft.com/downloads/details.aspx?FamilyID=1B6ACF93-147A-4481-9346-F93A4081EEA8&DisplayLang=enhttp://www.microsoft.com/technet/security/prodtech/windows2000/w2kccscg/w2kscgcb.mspxhttp://www.microsoft.com/windows2000/techinfo/planning/security/secdefs.asphttp://msdn.microsoft.com/library/periodic/period00/ewn0054.htmhttp://support.microsoft.com/?KBID=248260http://support.microsoft.com/?KBID=221930http://support.microsoft.com/?KBID=170834http://support.microsoft.com/?KBID=151720http://support.microsoft.com/?KBID=140058http://support.microsoft.com/?KBID=163905http://support.microsoft.com/?KBID=174074http://support.microsoft.com/?KBID=140714http://KB.UltraTech-llc.com/Docs/?File=AuditingWin2K.pdfhttp://KB.UltraTech-llc.com/Docs/?File=AuditingWin2K.dochttp://KB.UltraTech-llc.com/Docs/?File=Secure2000Pro.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ADDITIONAL SEARCH OPTIONS (MS KB)

• http://msdn.microsoft.com/http://www.microsoft.com/technet/http://www.microsoft.com/

  EXACT PHRASE ........... "File Audit"
  ALL WORDS .............. "Security Audit"
  ALL WORDS .............. "Local Security Policy"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


PERSONAL NOTES

• Sep 2005: Updated information on connecting via the
  MMC in 2000 and above.  Also added link to the Audit
  resource provided by Ed Ziots

• Process Tracking is hideously disk intensive, so I
  only configure it for purposes of an investigation,
  otherwise it stays off.  For the most part, I only
  care about logon failures, but I *always* want to
  be notified of policy changes.

• Once you enable Auditing, you should consider daily
  archiving of your EventLogs and expand them to a
  more reasonable size (say, 8MB or 16MB)

• Windows Server 2003 comes installed with more
  (and better) security defaults, along with more
  options for auditing.

• Group policy is the preferred mechanism for setting
  Auditing in 2000, XP and 2003.


RELATED SCRIPTS (ALSO IN THIS ARCHIVE)

• http://KB.UltraTech-llc.com/Scripts/?File=SetAudit.BAT


RELATED TOPICS (ALSO IN THIS ARCHIVE)

• http://KB.UltraTech-llc.com/?File=NTRights.TXThttp://KB.UltraTech-llc.com/?File=EventLog.TXThttp://KB.UltraTech-llc.com/?File=SysLog.TXThttp://KB.UltraTech-llc.com/?File=Perms.TXThttp://KB.UltraTech-llc.com/?File=Scripting.TXThttp://KB.UltraTech-llc.com/?File=Security.TXThttp://KB.UltraTech-llc.com/?File=ResKit.TXThttp://KB.UltraTech-llc.com/?File=ToolKit.TXThttp://KB.UltraTech-llc.com/?File=Utils.TXT

Comments are closed.