Disk Size Event are not getting generated from DCs.
While this Event Class is enabled for collection, unless the DC or the Agent are restarted, no data will be displayed.
Change Auditor does not generate this event for every disk on the server, but only the disk that stores SysVol and DSA are checked.
Furthermore, Change Auditor Agent only collect this information at boot.
However with Server Virtualization, this doesn't support Live Disk Extend or Shinkage
In order to capture the Disk Size Changed Event, Change Auditor does not currently generate this event for every disk on the server, but only the disk that stores SysVol and DSA are checked.
The agent first reads the following registry keys to see where SysVol and DSA are as below:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\Sysvol
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory
Then a Server or Change Auditor Agent restart is mandatory to capture that change.
Change Auditor will not capture the WHO, as natively this is not captured either in the Application log under Event ID 258
Solution
An Enhancement Request has been submitted for consideration in a future release of Change Auditor.
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center