Email Notification when NTFS perms are changed

[RabbieBurns]

Ive done both, but the events arent appearing in the logs

[SYNACK]

Here is a better guide but it appears you have already done what is says:

Auditing Windows Server 2008 File and Folder Access - Techotopia

 

Have you tried auditing a user account directly instead of the everyone group and setting the policy to audit everything.

[RabbieBurns]

it seems to be working in the sense that im getting event ID 4696 and 4698 when I view the permissions of the folders etc, but there are no 590 or any specific events actually logging the changing of the permissions.

[SYNACK]

have you tried changing the perms from a different account, maybe its not triggering the change as you are the owner of the folder? Not sure, never really played with it indepth.

 

I'd just switch on all the auditing options on the folder and work backwards from their if that made it work.

[RabbieBurns]

yeh testing with 2 seprerate accounts.. frustrating

[RabbieBurns]

OK I think I have it... I think its event eventID 4670 not 590 as written in the documentation linked somewhere in the thread!

[CyberNerd]

Just for completeness, this is really easy to do in Linux and has been part of the kernel for the last 6 yrs.

install inotify-tools then and watch for attribute changes:

 

#!/bin/sh
while inotifywait -e attrib /tmp/temp/file; do
mail -s "file perm changed" [email protected]
done

Edited November 2, 2011 by CyberNerd