Cannot limit file access auditing on Windows Server 2019

CatchAsCatchCan

8/15/24, 3:24 AM

I'm trying to implement file access auditing on a Windows Server 2019 machine with mixed success.

The server in question is a member server, but not a domain controller.

I know this is effective, because if I revoke this the File Access auditing stops.

I moved to enabling auditing at a folder level, but after I'd set up the auditing for a particular folder I found that the server was logging file access events for every event on the server. I checked back up the folder tree to see if there were any policies being inherited, but I found nothing.

So, with auditing enabled, and no auditing policies in place on any folder from the drive route to the shared folder, file access is still being logged throughout the shared folder.

I have worked across the whole drive and checked the audit policy at every key point: there are no audit policies in place.

If I've understood this process, I should only be seeing audit logs for folders and files with audit log entries, and anything below them where the entries are inherited.

To be quite sure, I took a sample log from the event viewer and followed the path, checking every folder from the drive root to the file. Nowhere did I find an audit entry of any kind.

I'm at a loss. I can enable and disable logging using a GPO, but once enabled I'm getting huge volumes of data I can't control, from logging I don't need or want.

I presume I've missed something here, but I have no idea what.

Suggestions?

1 + 4

active-directory

audit

group-policy

windows-server-2019

Greg Askew

8/15/24, 4:07 AM

Is there a reason you are using Windows Server 2003 Legacy Auditing and not the modern auditing introduced in 2008?

CatchAsCatchCan

8/15/24, 4:15 AM

I'm using the auditing options I see available. I have seen references to Advanced auditing, but the options for those don't appear in my GPO. Am I missing a template, perhaps?

Greg Askew

8/15/24, 4:38 AM

Advanced Auditing is not controlled with templates. `Security Settings\Advanced Audit Policy Configuration\System Audit Policies` https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-auditing-faq

CatchAsCatchCan

8/15/24, 4:51 AM

Thanks to your remark above, I've found it. An initial test seems to work. I hadn't seen Advanced Audit before because it wasn't adjacent to the basic Audit Policy I'd been using, but about a dozen items down the list, which was outside the window. Littlest things eh?

Score:0

Server

CatchAsCatchCan

8/15/24, 4:55 AM

I'd been using the basic Audit Policy in Security Settings | Local Policies.

I should have been using Advanced Audit Policy Configuration, but I hadn't seen that in the GPO because it's elsewhere in the Security Settings list, and not adjacent to Audit Policy, where I'd expected to find it.

Things were further confused because the entry appeared outside the window. A larger window, or a short scroll, or in this case Greg Askew's pointer in the comments got things fixed!

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Cannot limit file access auditing on Windows Server 2019

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.