Incorrect "failed folder access" event generated when access is denied to a file and it is opened (4219726)

Chat now with support

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Incorrect "failed folder access" event generated when access is denied to a file and it is opened
Description
When FULL DENY is explicitly set for a file in a folder in Windows 2008 R2 and the file is opened by the user, two events are recorded by Change Auditor
1. Access to file <file_name> was denied on <file_server> by NTFS permissions. (Denied access: read, write).
2. Access to folder <file_name>\ was denied on <file_server> by NTFS permissions. (Denied access: read, write).
It is expected that only the "Access to file" event should be recorded.
Resolution

WORKAROUND

None

STATUS

Waiting for fix in a future release of Change Auditor.
Defect ID

7004
Additional Information

The following behavior was noted in different operating systems: Windows 2008R2 - One failed file open and one failed folder open are reported on Change Auditor 6.8 when opened locally Windows 2008R2 - One failed file open and one failed folder open are reported on Change Auditor 6.8 when opened remotely Windows 2012R2 - Two failed file open and one failed folder open are reported on Change Auditor 6.8 when opened locally Windows 2012R2 - One failed file open and one failed folder open are reported on Change Auditor 6.8 when opened remotely

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title