Enable file auditing on windows server

Posted by Vivid_Mongoose_8964@reddit | sysadmin | View on Reddit | 10 comments

I have a few users who've come to me who all of a sudden had their permissions removed from an excel file and they can no longer open it. I have no power users in my company of 70 users and I'm the only admin with access to this type of stuff. I've enabled windows auditing on the file share for now, but this is a real head scratcher as to how this is occurring. Has anyone come across this and might offer some tips on where to look? All I can do for right now is sit back and check the audit logs and hope to catch something after it occurs when auditing was enabled so I've told 2 users to advise. Ty

Reply to Post

10 Comments

[-]

Vivid_Mongoose_8964@reddit (OP)

Thanks for the suggestions, but I should have mentioned, now that I'm reading the comments, these are occurring with the users Citrix profiles (file based, not container) that only they or an admin like myself would have access too. Just on a whim, I logged in with my citrix test account (user grade), and I could not access anyone else's profiles folders. Is there an auditing tool besides Windows auditing that is turned on to help with this perhaps?

[-]

maryteiss@reddit

Have you looked into FileAudit for this?

[-]

rcdevssecurity@reddit

You can have a look at Sysmon or the File Server Resource Manager, it might give you relevant logs on permission changes or file operations.

[-]

maryteiss@reddit

Check out FileAudit. You can track permissions as well as all file access. Answers the question who did what, when.

[-]

GullibleDetective@reddit

Tons of threads Look at Netwrix auditor tool

[-]

Vivid_Mongoose_8964@reddit (OP)

Going to look into this, ty

[-]

Key_Ad_5838@reddit

We use Netwrix Auditor in a few domains. Super beneficial. Only downside I've come across is allowing the server you are monitoring to be "autoconfigured". I recommend reading Netwrix Auditor's KBs and manually make the changes yourself.

[-]

thortgot@reddit

Anyone with full control could have made that change. Owner permissions also provide additional access.

[-]

odellrules1985@reddit

Check NTSF permissions for the share to see what permissions they have. If they have Full Control that is a big no-no. My last job we had users who had full control over the main share drive and one day someone decided to mess with permissions. My IT Director was pissed as he had to rebuild all the permissions and file structures, so we cut that off from everyone except IT. You should ideally have AD groups that have permission levels depending on need. In my company, for example, I have HR Users and HR Admin. Users can see files and create files while Admin can delete files. But neither can change permissions. You should make sure the owner is an IT AD Group so if you need to make changes or if you add in IT team members they can. Overall, I highly recommend making sure no user has full control or permission editing abilities. It just leads to chaos like this especially if you did not have file auditing turned on.

[-]

Master-IT-All@reddit

A file owner generally has the ability to change permissions on an object they create.