Solved How to create easier reporting for Windows auditing?

[exus69]

Hello,

My dad has all his important files in a folder named "IMP" in E: in Windows 7. I've set auditing object access failure and enabled auditing on the IMP folder and denied read access and delete folder for all other users.

Everything is working fine and I can check the event viewer whenever my dad wants to have a look at the logs. The problem is I am not always present when he wants to have a look at the logs and since he isn't too tech savvy it would be very difficult for him to go to event viewer, filter the log with event id no. 4656, Event Sources: Microsoft Windows security auditing, Task category: File System.

I was wondering if there is an easier way of generating logs for eg. automatically create a notepad file with all those filters once the audit failure triggers.

Please help

 

[bobafetthotmail]

probably by writing a bat file and executing with admin privileges... but you have to look if there is a way to do it with console commands to event viewer in the first place (it's likely possible).

I have a few of these "shortcuts", double click and Bam! A wall of commands gets executed. Time-saver man.

Why that anyway? If it is locked to other users what is there to log? Failed attempts to open it?

I really hope you are encrypting your drive, as this measure alone is a bit weak if the disk isn't encrypted. (a punk can simply boot that PC from a Linux liveCD or USB thumbdrive and access the unencrypted disk and those files ignoring the windows policy).

 

[exus69]

Why that anyway? If it is locked to other users what is there to log? Failed attempts to open it?

I really hope you are encrypting your drive, as this measure alone is a bit weak if the disk isn't encrypted. (a punk can simply boot that PC from a Linux liveCD or USB thumbdrive and access the unencrypted disk and those files ignoring the windows policy).

Yes he's interested in knowing who's nosy enough to try and explore his IMP folder. Haven't thought about encrypting the disk. Maybe I'll just encrypt his IMP folder. Thanks alot for the links.

Cheers

 

[bobafetthotmail]

meh, chances are you only get hits from kids and other less-savy users. But if it makes him feel safer... leave it be.