Return
-
Title
Is it possible to monitor a sub directory for a set of auditing tasks while also monitoring every other directory under the root for a different set of auditing tasks? -
Description
Consider the following: A File System Auditing Template is configured to audit C:\Windows (this object and all child objects) for file and folder creation, deletion and ACL changes. You also want to only monitor C:\Windows\Security\Database for file deletions.
-
Resolution
It is not possible to perform the required auditing by using a single template with exclusions (audit Windows and exclude the Database folder and have another path entry in the template for the Database folder). Nor is it possible to create a template just for the Windows folder and then one for the Database folder. To accomplish this level of auditing will require creating templates for each folder that needs to be audited, selecting to audit that object and child objects only. For example. You would require a template for the Windows folder and one for each subfolder you want to audit, specifying the type of auditing to be performed on each subfolder, such as just the deletion action for the Database folder path.