locked
Auditing RRS feed

  • Question

  • Hi All

    I have enabled auditing on a 2008 server and added the audit permissions to a folder I want to watch. I need to look for deleting of files and folder but am getting way too many records in the event logs at present.

    I have been looking at

    auditpol /get /category:"Object Access"

    I wanted to know which sub categories I actually need enabled for this so I can disable the rest to reduce the data in the event logs

    Many thanks

    Glenn

    Wednesday, September 26, 2012 11:14 AM

Answers