We had an issue where a user's share permissions for a folder got changed, and no one claims to know how it happened.
We think have auditing turned on so those types of changes show up in event logs, but aren't seeing any indication of who made the change. Either we don't have the right things being audited, or we don't know what event log items to look for. So, which event log entries would tell us who made a permission change? Would we look on the server hosting the share, or in the AD controller? This is in a W2K3 environment. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
