V
V
VlLight2018-11-15 15:51:53
System administration
VlLight, 2018-11-15 15:51:53

Folder creation audit does not work in Windows 7. What to do?

I want to set up an audit of file operations in Windows 7, but I came across the fact that the audit of folder creation does not work (events do not come to the Event Viewer snap-in). On deleting a file/folder, the event comes, on creating a file it also comes, on creating a folder - no. Checked on 2 machines with Windows 7 and on one with 2008 R2 - the behavior is identical.
In the policies, file system auditing is enabled (Local Computer Policy policy -> Windows Settings -> Security Settings -> Advanced audit policy configuration -> System audit policy - Local group policy object (System audit policies - Local group policy object) -> Access to objects (Object Access) -> Audit file system: success, failure (Audit file system: Success, Failure)).
Audit of the test folder is enabled, for the "Everyone" groups the events "Creating files/writing data", "Creating folders/adding data", "Deleting subfolders and files", "Deleting" are selected. In some manuals, it is also advised to enable the "Reading attributes" event, I tried to enable it - nothing changes (except that the "Reading attributes" events appear in the "Event Viewer").
Has anyone experienced this behavior?
Upd: I found Windows 2003 x86, and it's the same there.

Answer the question

In order to leave comments, you need to log in

1 answer(s)
A
azzii, 2020-07-13
@azzi

Confirming that folder creation auditing is not working. I found two links on technet on the topic, but they do not answer the question, they also suggest enabling attribute auditing.
Topic 1
Topic 2
When attribute auditing and folder creation auditing are enabled, three events with the code 4663 are generated after folder creation, in one of which the object name is the name of the created folder, but it is possible to understand that this event is folder creation only indirectly.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question