Auditing events 4656 and 4658 on Windows folder on Server 2008

Posted by PCurd on Server Fault See other posts from Server Fault or by PCurd
Published on 2009-07-22T13:24:35Z Indexed on 2010/03/20 22:01 UTC
Read the original article Hit count: 542

Filed under:

windows-server-2008

|

audit

|

security

During an overnight system state backup we are seeing thousands of success audit events (4656, 4658) on the folder c:\windows\servicing, system32 and others in the windows folder.

We use file success auditing on some files so I can't disable it but this deluge is filling up the logs and making reporting tricky.

What is the harm of changing the auditing settings on the windows folder?

What are the recommended settings to put on the files for those people doing system state backups?

Thanks,

© Server Fault or respective owner

Related posts about windows-server-2008

Password policy problem windows server 2008

as seen on Server Fault - Search for 'Server Fault'
Hi, I'm creating a domain and I need to make users that can have an empty password but administrators have to comply with password complexity how to I solve this problem? Thanks in advance >>> More
SAP DCOM Connector on Windows Server 2008

as seen on Stack Overflow - Search for 'Stack Overflow'
Does anybody know, if it is possible to use the "old" SAP DCOM Connector on a Windows Server 2008 ? I want to migrate a old ASP Web Solution with DCOM Connection to SAP from Windows 2000 Server to Windows 2008 Server. When I try to install the DCOM Connector I get the Error Message: "Setup could… >>> More
Windows Server 2008 R2: AD Module for Windows PowerShell

as seen on Internet.com - Search for 'Internet.com'
Windows Server 2008 R2 includes a new Active Directory module for Windows PowerShell, a consolidated group of 76 cmdlets that can perform a host of tasks against Active Directory's various services. >>> More
Windows Server 2008 Directory Services, Group Policy Preferences - More Control Panel Settings

as seen on Internet.com - Search for 'Internet.com'
In Windows Server 2008, Group Policy Preferences makes it possible to reap the chief benefits of an Active Directory environment by simplifying client management. Control Panel Settings nodes in the Group Policy Management Editor makes this possible. >>> More
Windows Server 2008 R2: Introducing the AD Administrative Center

as seen on Internet.com - Search for 'Internet.com'
The Active Directory Administrative Center in Windows Server 2008 R2 is a significant improvement over its predecessor. Although not without limitations, it offers beefed-up management of AD objects, new navigation capabilities, better task-based management options, and improvements to the properties… >>> More

Related posts about audit

How to allow bind in app armor?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Question: I did setup bind9 as described here: http://ubuntuforums.org/showthread.php?p=12149576#post12149576 Now I have a little problem with apparmor: If I switch it off, it works. If apparmor runs, it doesn't work, and I get the following dmesg output: [ 23.809767] type=1400 audit(1344097913… >>> More
New in MySQL Enterprise Edition: Policy-based Auditing!

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Normal 0 false false false EN-US X-NONE X-NONE … >>> More
Configuring Granular Settings for a Database Level Audit

as seen on Internet.com - Search for 'Internet.com'
Learn how to create a database level audit at a granular level and retrieve the audit records in this 9-step tutorial. >>> More
Creating a standard audit trail in Oracle Database 11g

as seen on Internet.com - Search for 'Internet.com'
Turning on auditing is easy; knowing what to do with it is entirely different. Learn how to create a standard audit trail using Oracles Enterprise Manager. >>> More
SQL Server 2008 : Accessing Audit Details

as seen on Internet.com - Search for 'Internet.com'
Learn how to use the SQL Server 2008 catalog view and dynamic management view to access the audit details of existing server and database level audits. >>> More