Setting up Auditing on one server in domain only.

[tosca925]

I need to set up auditing to track changes to folders and files on one server in the domain. I do not want to set his accross all servers so i suppose i need to edit the local GPO?????

 

What is the best way to do this and what are the pitfalls? I need to get this up and running a.s.a.p.

 

How would i go about this?

 

I need to know who accessed file or folder, when and if it was changed?

[Geoff]

Here's a KB article.

 

http://support.microsoft.com/kb/301640

[tosca925]

Should i choose Full Control for the auditing?

[Geoff]

If you just want to track changes to files/folders you just need:

 

Create Files

Create Folders

Delete Subfolders

Delete

[tosca925]

Should the event viewer tell me who renamed/deleted a file or folder?

[Geoff]

If their account or a group they are a member of is listed as being audited for the file/folder in question, yes. The Security Log will tell you.

[tosca925]

need to test it out now

[tosca925]

Right,

 

It lookslike it shows them accessing the folder but it does not show an event for the renaming of the folder.

 

IS this correct or have i set this up wrong?