How to identify/monitor a deny access action in Windows 2008 SP1 ?

[williamhui]

Hello,

With enabled all audit tracking in Windows Local Security Policy and the monitoring folders, I was able to identify the person (Account_Name) who is using an application (Process_Name) to do an action (Accesses) on specified folder/file (Object_Name).
However, I was unable to find whether my action is success or not. (The audit is success). Could anyone help on this ?

Many Thanks,
William

[acilia]

"Reason for access" reporting is the ACEs in Win 2008 R2 provides the privileges on which the decision to allow or deny access to the object and also record the action allow or deny the occurrence of a particular event.

Therefore, the root cause is that Win 2008 does not support Reason for access which Win 2008 R2 supports.

[keiichilam]

一定係你做錯。

[LCM]

I would agree to that answer 😉