Hmm... since it's the share permissions, you'd probably have to audit changes to the registry key where those are stored under
HKLM\System\CurrentControlSet\Services\LanManServer\Shares -Bonnie From: Kim Longenbaugh [mailto:[email protected]] Sent: Monday, January 25, 2010 12:33 PM To: NT System Admin Issues Subject: auditing for ntfs and share permissions changes We had an issue where a user's share permissions for a folder got changed, and no one claims to know how it happened. We think have auditing turned on so those types of changes show up in event logs, but aren't seeing any indication of who made the change. Either we don't have the right things being audited, or we don't know what event log items to look for. So, which event log entries would tell us who made a permission change? Would we look on the server hosting the share, or in the AD controller? This is in a W2K3 environment. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
