Good afternoon Is anyone making use of cDOT auditing capabilities on CIFS shares? I've set up a demo implementation to toy around with and the log output leaves something to be desired, in terms of immediate usefulness/understandability. I was hoping for something that I could hand off to an end user when they ask "why did file X get moved to directory Y?".
My demo auditing policy only has file-ops enabled, and the demo share (on NTFS volume) I am testing auditing with has advanced auditing permissions Create Files/Write Data, Create Folders/Append Data, Delete Subfolders and Files, Delete, Change Permissions, and Take Ownership enabled against my demo user.
When I connect to this share as the demo user and create a directory, copy a file into it, create a subdirectory, move the file into this subdirectory, I do indeed get logging events I can view with Windows Event Viewer. Technically auditing is working. However, it is difficult to actually put together a chain of events based on the logged information with just my single user access, nevermind thousands of users across hundreds of shares.
What are other people using to make sense of this audit data? Exporting via XML instead of EVTX and feeding it to.. something? Custom parsers? Spending hours with the awful Event Viewer and filters when your boss's boss wants an explanation for why files moved? :)
Ian Ehrenwald Senior Infrastructure Engineer Hachette Book Group, Inc. 1.617.263.1948 / ian.ehrenwald@hbgusa.com