Return
-
Title
InTrust "File Access" report does not contain any data -
Description
When running the InTrust "File Access" report, the report does not contain any data even though it has been confirmed that the InTrust Repository and InTrust Audit Database contains the File Access Event ID 4663. -
Cause
The InTrust "File Access" report only reports the details on the EventID 4663 events when they are accompanied by corresponding EventID 4656 and EventID 4658 events. The reasoning behind this is because the 4663 event documents actual operations performed against files and other objects. This event is logged between the open (4656) and close (4658) events for the object being opened and can be correlated to those events via the Handle ID. -
Resolution
RESOLUTION 1:Enable the local security policy "Security Settings/Advanced Audit Policy Configuration/Object Access/Audit Handle Manipulation" to record the open (EventID 4656) and close (EventID 4658) events. Please note that this may cause the Security logs to grow more quickly and should be tested to ensure desirable results.RESOLUTION 2:Configure a Search within Repository Viewer to report on the desired EventID 4663 events.