I would like to setup file auditing on our file server to see who is
deleting files. We are using Server 2003 Enterprise which is the
domain controller.
Here is the problem. I go into the Group Policy Editor and enable
auditing on "Audit Object Access." Then I add the ACL on the certain
folder on want to watch.
In my security log, I get a new entry every half second barking about
successful registry changes. This machine has never been touched in
terms of setting up auditing. I have gone to "regedit" and looked at
the permissions on each root folder. No auditing seems to be set at
the root. What can I do to stop the auditing of the registry? Is there
an easy way to see all ACL's that are set? Thanks!