|
The Windows 2008R2 "Special Groups" feature allows for detailed tracking of domain administrators when they log into the machine. This is accomplished by editing a registry key or the LSA. Is there a similar action that can be done for the File, Print, or other types of logging? |
|||
|
|
|
Yes. The answer is just plain old object-access auditing with audit policy and Audit ACLs. First, you enable the system audit policy for tracking successful access of files and object. Don't worry, this won't make insane amounts of log messages (though domain controllers do get a bitnoisier due to default Audit ACLs (SACLs)). Second, in active directory or the file system, you find objects you want to audit access to. Edit the properties, go in advanced security settings/Audit tab. Then you add the users or groups that you want to track, then you select the type of activity you want to track. When users access this object, the system checks if there is a SACL and if this type of access should result in a security eventlog message. A more thorough overview: http://technet.microsoft.com/en-us/library/cc787413(v=ws.10).aspx |
|||
|
|
