Are you looking at the DC or the server where the share resides? If the share was NOT on a DC and you are looking there then I would suspect who ever did it was using a local account for the server.
Jon On Mon, Jan 25, 2010 at 3:42 PM, Miller Bonnie L. < [email protected]> wrote: > Hmm… since it’s the share permissions, you’d probably have to audit > changes to the registry key where those are stored under > > > > HKLM\System\CurrentControlSet\Services\LanManServer\Shares > > > > -Bonnie > > > > *From:* Kim Longenbaugh [mailto:[email protected]] > *Sent:* Monday, January 25, 2010 12:33 PM > > *To:* NT System Admin Issues > *Subject:* auditing for ntfs and share permissions changes > > > > We had an issue where a user’s share permissions for a folder got changed, > and no one claims to know how it happened. > > > > We think have auditing turned on so those types of changes show up in event > logs, but aren’t seeing any indication of who made the change. Either we > don’t have the right things being audited, or we don’t know what event log > items to look for. > > > > So, which event log entries would tell us who made a permission change? > Would we look on the server hosting the share, or in the AD controller? > > > > This is in a W2K3 environment. > > > > > > > > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
