Are you looking at the DC or the server where the share resides?  If the
share was NOT on a DC and you are looking there then I would suspect who
ever did it was using a local account for the server.

Jon

On Mon, Jan 25, 2010 at 3:42 PM, Miller Bonnie L. <
[email protected]> wrote:

>  Hmm… since it’s the share permissions, you’d probably have to audit
> changes to the registry key where those are stored under
>
>
>
> HKLM\System\CurrentControlSet\Services\LanManServer\Shares
>
>
>
> -Bonnie
>
>
>
> *From:* Kim Longenbaugh [mailto:[email protected]]
> *Sent:* Monday, January 25, 2010 12:33 PM
>
> *To:* NT System Admin Issues
> *Subject:* auditing for ntfs and share permissions changes
>
>
>
> We had an issue where a user’s share permissions for a folder got changed,
> and no one claims to know how it happened.
>
>
>
> We think have auditing turned on so those types of changes show up in event
> logs, but aren’t seeing any indication of who made the change.  Either we
> don’t have the right things being audited, or we don’t know what event log
> items to look for.
>
>
>
> So, which event log entries would tell us who made a permission change?
> Would we look on the server hosting the share, or in the AD controller?
>
>
>
> This is in a W2K3 environment.
>
>
>
>
>
>
>
>
>
>

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/>  ~

Reply via email to