File Audit

[snakesboy]

I have set the file audit modify and delete and which event ID
represent a user have modified or
have deleted the file .I hope to kbow which user have modified and
delete of the special fle

 

[Herb Martin]

"snakesboy" <snakesboys@gmail.com> wrote in message
news:1183716064.137043.208140@o11g2000prd.googlegroups.com...
>I have set the file audit modify and delete and which event ID
> represent a user have modified or
> have deleted the file .I hope to kbow which user have modified and
> delete of the special fle

You have to also enable File (i.e., OBJECT Auditing) in the Local
Security Policies or through a GPO.

Auditing of files and other objects requires TWO types of settings:

1) ACLs on the Files (like permissions but for auditing)

2) General enabling of the auditing

Both are required.


--
Herb Martin, MCSE, MVP
http://www.LearnQuick.Com
(phone on web site)