Hey, folks... I've been lurking on EHN lately and am glad to post and interact some more now. Here's an interesting one that's been bugging me lately:

I've got a client who wants to audit users' attempts to access directories they shouldn't on Windows 2003 servers. Of course, he has enable auditing object access for the specific directories, and the 560 "Failed" events start showing up in the Event Log.

The problem is, lots of unexpected failure events show up too--apparently Windows Explorer is doing "drive-by" peeks at the other folders nearby the one you're accessing?

Let me explain: If I'm auditing some of the folders under \\server\users, e.g. \\server\users\dontgohere, and I login and browse to \\server\users\myusername, then look in the Security Event Log, I will see at least 3 #560 "Failed" events saying that I just tried to read the folder \\server\users\dontgohere!

Presumably, this is because Windoze is looking at the folder properties. I assume I can't really do anything to prevent that?

So... my real question is: anyone know a way I can audit when people are really trying to access the folder, and avoid the false-alarms caused by the Windows Explorer drive-bys?

TIA--

Ah... wouldn't you know it, I think I may have found a trail to follow...

When Windoze Exploder gives the false alarms, it is only asking for a few permisions, namely "ReadData (or ListDirectory)" and sometimes "SYNCHRONIZE"--which works out to be Access Mask 0x1 or 0x100001.

So, if I filter out the 560 errors with those access masks, I get only the "real" alarms, in which actual attempts to browse that folder request much more access ("READ_CONTROL", "ReadEA", etc.... mask 0x120089, for example).

I may have answered my own question.

You can use Microsoft LogParser for filtering out your Log files (remotely also). Enter the parameters and you can get the output in various formats.

Download Microsoft LogParser 2.2
http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

Microsoft Log Parser Toolkit [ILLUSTRATED]
http://www.amazon.com/Microsoft-Parser-Toolkit-Gabriele-Giuseppini/dp/1932266526

You may want to remove some of the more curious users's tendancies by hiding the folders they shouldn't be poking around in the first place. 


Have a look at this:

http://www.windowsnetworking.com/articles_tutorials/Implementing-Access-Based-Enumeration-Windows-Server-2003.html