Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Windows 2008R2 "Special Groups" feature allows for detailed tracking of domain administrators when they log into the machine. This is accomplished by editing a registry key or the LSA.

Is there a similar action that can be done for the File, Print, or other types of logging?

share|improve this question

1 Answer 1

Yes. The answer is just plain old object-access auditing with audit policy and Audit ACLs.

First, you enable the system audit policy for tracking successful access of files and object. Don't worry, this won't make insane amounts of log messages (though domain controllers do get a bitnoisier due to default Audit ACLs (SACLs)).

Second, in active directory or the file system, you find objects you want to audit access to. Edit the properties, go in advanced security settings/Audit tab. Then you add the users or groups that you want to track, then you select the type of activity you want to track.

When users access this object, the system checks if there is a SACL and if this type of access should result in a security eventlog message.

A more thorough overview: http://technet.microsoft.com/en-us/library/cc787413(v=ws.10).aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.