# Another Dumbass Computer Question
**URL:** https://forums.speedlife.net/t/another-dumbass-computer-question/189142
**Category:** PittSpeed Off Topic
**Created:** [April 9, 2007, 10:35am UTC](https://forums.speedlife.net/t/another-dumbass-computer-question/189142 "2007-04-09T10:35:23Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Swarzkopf](https://forums.speedlife.net/u/Swarzkopf)
#### Post date: [April 9, 2007, 10:35am UTC](https://forums.speedlife.net/t/another-dumbass-computer-question/189142/1 "2007-04-09T10:35:23Z")
You guys were real helpful last time…can you follow it up with another stellar performance? 😃 I sure hope so!
So I’ve inherited my company’s OVOW administration and I’m trying to set up some alerts for failed object access attempts across our network.
In a test OU I configured a GPO which audits and records failed object access attempts to the security log on the box where the object resides. This works great and as expected for **local** object access events (whenever someone is either terminaled into the box or sitting at the console and trying to access the object); however, when accessing files in shared folders across the network no failed object access event is logged, even when the user receives an access denied message…the only logged event is ID 538 (account logon event) and these show up as SUCCESSES in Event Viewer (even though they are clearly failing).
So…does anyone know of any way to audit attempted network object access to shared folders? None of the M$ stuff is being very helpful.
Help is genuinely appreciated…I need to start buying you guys beer or something. 😃
---
### Author:  [@Swarzkopf](https://forums.speedlife.net/u/Swarzkopf)
#### Post date: [April 9, 2007, 6:20pm UTC](https://forums.speedlife.net/t/another-dumbass-computer-question/189142/2 "2007-04-09T18:20:58Z")
No one!? Come on, who wants to show how big their IT penis is?
---
### Author:  [@gt420hp](https://forums.speedlife.net/u/gt420hp)
#### Post date: [April 9, 2007, 7:00pm UTC](https://forums.speedlife.net/t/another-dumbass-computer-question/189142/3 "2007-04-09T19:00:26Z")
I would use some utility programs. Give GFI a try.
> **[Event Log Viewer and Analyzer, Network Monitoring and Management Software | GFI...](https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-eventsmanager)**
>
> GFI EventsManager performs network wide log monitoring, analysis, management and archiving. GFI EventsManager also offers event log based intrusion detection and allows organizations to be compliant with a range of compliance regulations.
---
### Author:  [@1st\_v-dub](https://forums.speedlife.net/u/1st_v-dub)
#### Post date: [April 10, 2007, 6:30am UTC](https://forums.speedlife.net/t/another-dumbass-computer-question/189142/4 "2007-04-10T06:30:15Z")
> [@Another one of those Buffalo on the move threads...](https://forums.speedlife.net/t/another-one-of-those-buffalo-on-the-move-threads/27410/21):
>
> No one!? Come on, who wants to show how big their IT penis is?
:bowrofl: sorry dude, I’ve been getting my ass kicked by some group policy that campus was loading. I’m exchange superhero, I suck at gpo…
If I get some time I’ll try to look around today…
---
### Author:  [@fshowcars](https://forums.speedlife.net/u/fshowcars)
#### Post date: [April 10, 2007, 12:06pm UTC](https://forums.speedlife.net/t/another-dumbass-computer-question/189142/5 "2007-04-10T12:06:36Z")
hey man… sorry i didn’t respond… no cut and dry answer really… as far as event tracking, i’ve used good old text based logs… but a good program is called Event Comber, which will query logs for given events… you can search by event id, by keyword, by user… ect.ect.
MOM will also trigger events based on event ID’s… but i’ve never used it for something like you’re asking for…
from what i’m reading, you want something that returns the attempted connection to network shares? no events are logged when failed attempts are made??? i suppose you could setup ntfs auditing on the share if it’s something specific… just watch your disk space… tons of people dump logs and run out of free space on the volumes…
---
### Author:  [@whitey](https://forums.speedlife.net/u/whitey)
#### Post date: [April 10, 2007, 12:12pm UTC](https://forums.speedlife.net/t/another-dumbass-computer-question/189142/6 "2007-04-10T12:12:43Z")
sorry, just read it. Sonny pretty much summed it up. We had a situation where an employee was coming through and deleting random files. Turning on security logging helped us figure out who it was, but I think this would be even easier if you just ran MOM to report on the eventid. its pretty cake to do, it will take you no more then 15 minutes to make it do exactly what you need.
---
### Author:  [@Swarzkopf](https://forums.speedlife.net/u/Swarzkopf)
#### Post date: [April 10, 2007, 3:21pm UTC](https://forums.speedlife.net/t/another-dumbass-computer-question/189142/7 "2007-04-10T15:21:05Z")
Thanks guys…I figured out the problem, as with 99% of IT issues it was PLBCAK. Hey, I never claimed to not be a dumbass. 😃
I’d initially configured NTFS auditing on the folders I wanted to audit, but never forced propagation down to the file level…hence why network access to specific files was not showing up. I forced the audit settings to propagate to all child containers and bam, my events showed up.
It’s working now, setup like this:
-A GPO enables auditing for the machines in question
-Object auditing is configured for the shared folders and forced to propagate to all child objects
-An OpenView policy is deployed to and reads the security logs on the audited machines
-When a failure event 560 is generated the OpenView policy sends me an email telling me who is trying to access what
Thanks!