question

MPEG avatar image
0 Votes"
MPEG asked RogerXue-3369 answered

Audit Files and Folder

Hi, How can I audit on one of my File Server who has delete or edit create files or directory? I am using SCOM 2019 server. Regards

msc-operations-manager
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

AlexZhu-MSFT avatar image
0 Votes"
AlexZhu-MSFT answered AlexZhu-MSFT edited

Hi,

To achieve this, we need to 1) enable file system auditing for the target computers; 2) crate a monitor/rule based on the specific Event ID generated above. For the step-by-step guide, we may refer to:

https://www.varonis.com/blog/windows-file-system-auditing/

https://infrontconsulting.asia/scom-create-monitor-based-on-event-viewer-log/

Note: the above articles are not from MS, just for your reference.


Regards,

Alex
If the response is helpful, please click "Accept Answer" and upvote it.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

RogerXue-3369 avatar image
0 Votes"
RogerXue-3369 answered

May be consider using MARTELLO SCOM Files and Folders Monitoring Management Pack
https://martellotech.com/downloads/mp-scom-files-folders-monitoring/

Roger

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.