Folder files open during folder browsing
Tuesday, September 15, 2009 at 3:49 am
Posted by sbonacina
(1 messages posted)
Hi all, experts
I have the following problem: I need to audit object access to files contained in
a particular folder.
I set it up in the local security policy and in the folder security properties.
I have a series of events fired whenever I access a particular file, and this is
good.
What is not, is that I've got lots of events when just browsing the folder using
Windows Explorer.
Windows 2003 fires an event for any single files into the directory: the event ID
is 560 (which is the event related to object access, good), and is like this one:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\TEST\mng_lgwr_428.trc
Handle ID: 2492
Operation ID: {0,17148959}
Process ID: 3020
Image File Name: C:\WINDOWS\explorer.exe
Primary User Name: Administrator
Primary Domain: LOGONE
Primary Logon ID: (0x0,0xE2C12C)
Client User Name: Administrator
Client Domain: LOGONE
Client Logon ID: (0x0,0xE2C12C)
Accesses: READ_CONTROL
ACCESS_SYS_SEC
ReadAttributes
Privileges: SeSecurityPrivilege
Restricted Sid Count: 0
Access Mask: 0x1020080
Any idea why this happens? Maybe something in the folder settings?
Thanks in advance for your reply
Stefano
[Reply or follow-up to this message]
|
