You could use windows event logs or a third party utility for this. As with most things the windows function is free but difficult to use and somewhat limited. However, you could enable "audit object access" in the local security policy and choose success action. Then enable auditing on the hosts file of write access. Then check your event viewer for 4663 . Then create an event viewer check in Servers Alive. Use security event log, eventID 4663 and success audit. If you want you can specify the name of the file in the description should contain box.
You won't know what changed but you would know that something changed. Then you could use a diff tool to get the changes when you have an issue. If I remember correctly one of the salive file checks will actually move a file. Make it dependent on the eventlog check and make an archive of each change?. Just spit-balling but maybe it will get you a start. Jason Passow Network Administrator Mississippi Welders Supply http://www.mwsco.com (http://www.mwsco.com) [email protected] (mailto:[email protected]) ph: (507) 494-5178 fax: (507) 454-8104 -------------------------------------------------------------------------------- From: David Bruck [mailto:[email protected]] To: Servers Alive Discussion List [mailto:[email protected]] Sent: Fri, 27 Jan 2012 10:30:22 -0600 Subject: Re: [SA-list] Logging changes made in SA itself This is a customer requirement and they have told us there are other tools that do it. We don't want to switch..... On Fri, Jan 27, 2012 at 11:17 AM, Barry George <[email protected] (mailto:[email protected])> wrote: A Change Log written by SA every time a change is made? Thatâs a big ask. IMHO get you Admins to document their changes in SharePoint or a word doc. If they canât do that? Consider getting new Admins? ;) From: David Bruck [mailto:[email protected] (mailto:[email protected])] Sent: January-27-12 10:31 AM To: Servers Alive Discussion List Subject: [SA-list] Logging changes made in SA itself Is there a way, and if not, are there any plans to add this: capability to log changes made by an admin to anything in serverslive based on their domain account or other identifying factor? Thanks in advance, Dave To unsubscribe send a message with UNSUBSCRIBE in the subject line to [email protected] (mailto:[email protected]) If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to [email protected] (mailto:[email protected]) If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to [email protected] (mailto:[email protected]) If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to [email protected] If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list.
