Enabling NTFS Auditing

[RabbieBurns]

Ive been asked to turn on NTFS auditing on our file servers so we can track who is doing what with the files.

 

Is there a decent article I can read that will cover issues like overhead, usage, requirements, offloading logs to something like splunk etc, and also a best practices HOW-TO guide of implementation?

[psydii]

http://m.windowsecurity.com/articles-tutorials/authentication_and_encryption/Deploying-Auditing-Settings-Reporting-What-Configured.html

(Overview and a good selection of links)

 

http://blogs.technet.com/b/askds/archive/2011/03/10/global-object-access-auditing-is-magic.aspx

 

http://blogs.technet.com/b/askds/archive/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2.aspx

 

http://www.microsoft.com/en-us/download/details.aspx?id=16776

(Definitive documentation, best practice and toolkit - it will take a while just to find just the info you need, but it will be in here)

[RabbieBurns]

Thats awesome, thanks very much