What is the Event id for File & folder creation in Window Server 2008

All replies

• 

  

  0

  Sign in to vote

  Hello Param, 

  See this http://www.techrepublic.com/article/step-by-step-how-to-audit-file-and-folder-access-to-improve-windows-2000-pro-security/5034308

  ---

  Regards, Ravikumar P

  Monday, November 5, 2012 11:16 AM
• 

  

  0

  Sign in to vote

  Hi Param,

  Below link may help you....

  http://sogeeky.blogspot.co.uk/2006/07/how-to-audit-and-track-file-deletions.html

  ---

  Rajesh J S

  Monday, November 5, 2012 1:01 PM
• 

  

  0

  Sign in to vote

  Following should help

  Using Windows Auditing to track user activity (By Peter Gubarevich)

  http://blog.windowsnt.lv/2011/11/15/tracking-user-activity-english/

  Tracking a Remote File Deletion Back to the Source (By Ned Pyle)

  http://blogs.technet.com/b/askds/archive/2009/08/04/tracking-a-remote-file-deletion-back-to-the-source.aspx

  Thanks

  ---

  Regards, Santosh
  
  I do not represent the organisation I work for, all the opinions expressed here are my own.
  
  This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
  
  Whenever you see a helpful reply, click on Vote As Helpful & click on Mark As Answer if a post answers your question.

  Monday, November 5, 2012 2:33 PM
• 

  

  1

  Sign in to vote

  Hi,

  To track files&folders creation please track event 560 on Windows Server 2003 or Window XP (corresponding 4616 for Windows 2008 and Vista and later) in the security log.

  Please refer to:

  File System Auditing – Window 2003
  http://whatevernetworks.com/?p=108
  560: Object Open
  https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=560

  A previous similar thread:

  http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/ac375439-e5f1-4252-a553-38feb12e48b6/

  Regards,
  Cicely

   

  • Marked as answer by Cicely Feng Wednesday, November 14, 2012 6:27 AM

  Tuesday, November 6, 2012 1:56 AM
• 

  

  0

  Sign in to vote

  This is no longer true. 4616 is system log time was changed.

  Thursday, July 30, 2020 5:37 PM