We are in the process of setting ADAudit Plus up in our environment. Yesterday I worked with support for a while and they indicated that group policy was not setting the audit policies correctly on the server. I finally figured out that a setting in the ADAuditPlus group policy that the software created had to be changed and then it started auditing events.
My problem now is that some file\folder actions appear to register with the console and some do not. I have only 1 share, which is a test share, that is currently being audited. This afternoon I have tested renaming a file, deleting a file and moved files and folders and these actions are not being registered. The support tech I worked with yesterday changed my Security log size to 700MB and it is only currently at 50BM used so size and events overwriting is not a problem.
To focus on one specific test, I tested deleting a file:
- Verified that server is showing correct auditpol settings using "auditpol.exe /get /category:*"
- Verified that SACLS are correctly applied to the shared folder
- Deleted a file from the shared folder
- Verified present of Security Log entry showing file was deleted
- Manually initiated data collection for share in question under Configured Servers->Windows File Server
- Checked both Files Deleted report and All File or Folder Changes report and no entries exist for deleted file
I would appreciate any assistance as we would really like to get this configured and begin using it, but first have to know that it is working and reporting correctly.
Thanks in advance