Archive

How to identify/monitor a deny access action in Windows 2008 SP1 ?

New Member

Hello,

With enabled all audit tracking in Windows Local Security Policy and the monitoring folders, I was able to identify the person (Account_Name) who is using an application (Process_Name) to do an action (Accesses) on specified folder/file (Object_Name).
However, I was unable to find whether my action is success or not. (The audit is success). Could anyone help on this ?

Many Thanks,
William

Tags (1)
0 Karma

New Member

"Reason for access" reporting is the ACEs in Win 2008 R2 provides the privileges on which the decision to allow or deny access to the object and also record the action allow or deny the occurrence of a particular event.

Therefore, the root cause is that Win 2008 does not support Reason for access which Win 2008 R2 supports.

0 Karma

Explorer

一定係你做錯。

0 Karma

Contributor

I would agree to that answer 😉

0 Karma