Home Operation and Maintenance Windows Operation and Maintenance Detailed explanation of turning on the audit function in Windows to record file deletion operations

Detailed explanation of turning on the audit function in Windows to record file deletion operations

May 26, 2017 am 11:04 AM

Problem description:

Some files on the Windows machine were abnormally deleted and packaged. Intrusion suspected. How to troubleshoot.

Problem Solution:

1. Configure Group Policy

Select "Run" from the Start menu to open "Group PolicyEditor

Detailed explanation of turning on the audit function in Windows to record file deletion operations

Navigate to [Computer Configuration]--[Windows Settings]--[Security Settings]--[AdvancedAuditPolicy Configuration]--[System Audit Policy]--[Object Access], double-click [Audit File System] on the right, check [Define these policy settings] and [Success] items and [Failure] items do not need to be checked.

Detailed explanation of turning on the audit function in Windows to record file deletion operations

2. Add audit directory

Right-click the folder that needs to be audited, select [Properties], and then switch to [ Security] tab, click the [Advanced] button, switch to the [Audit] tab in the new dialog box, add users and groups to be audited, and check and delete related items in [Audit Projects] . It is necessary to audit everyone's deletion actions of the folder and subfolders.

For example, the C:\tmp configuration in the test environment is as follows:

Right-click the directory C:\tmp and select [Security]->[Advanced], select [Audit], and then add, for the subject [everyone], review [Delete subfolders and files] in the advanced permissions, [Delete] 2 items

Detailed explanation of turning on the audit function in Windows to record file deletion operations

Additionally, to increase the size of the security log, in the Event viewer, right-click Security and set the log size to 120512KB

Detailed explanation of turning on the audit function in Windows to record file deletion operations

3. Test, delete C:\tmp\testfile.txt, and then find the record with event ID 4646 in the security log as follows, which shows that the administrator user performed the operation through explorer.exe.

The above is the detailed content of Detailed explanation of turning on the audit function in Windows to record file deletion operations. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Can I install mysql on Windows 7 Can I install mysql on Windows 7 Apr 08, 2025 pm 03:21 PM

Yes, MySQL can be installed on Windows 7, and although Microsoft has stopped supporting Windows 7, MySQL is still compatible with it. However, the following points should be noted during the installation process: Download the MySQL installer for Windows. Select the appropriate version of MySQL (community or enterprise). Select the appropriate installation directory and character set during the installation process. Set the root user password and keep it properly. Connect to the database for testing. Note the compatibility and security issues on Windows 7, and it is recommended to upgrade to a supported operating system.

How to solve mysql cannot connect to local host How to solve mysql cannot connect to local host Apr 08, 2025 pm 02:24 PM

The MySQL connection may be due to the following reasons: MySQL service is not started, the firewall intercepts the connection, the port number is incorrect, the user name or password is incorrect, the listening address in my.cnf is improperly configured, etc. The troubleshooting steps include: 1. Check whether the MySQL service is running; 2. Adjust the firewall settings to allow MySQL to listen to port 3306; 3. Confirm that the port number is consistent with the actual port number; 4. Check whether the user name and password are correct; 5. Make sure the bind-address settings in my.cnf are correct.

Solutions to the errors reported by MySQL on a specific system version Solutions to the errors reported by MySQL on a specific system version Apr 08, 2025 am 11:54 AM

The solution to MySQL installation error is: 1. Carefully check the system environment to ensure that the MySQL dependency library requirements are met. Different operating systems and version requirements are different; 2. Carefully read the error message and take corresponding measures according to prompts (such as missing library files or insufficient permissions), such as installing dependencies or using sudo commands; 3. If necessary, try to install the source code and carefully check the compilation log, but this requires a certain amount of Linux knowledge and experience. The key to ultimately solving the problem is to carefully check the system environment and error information, and refer to the official documents.

MySQL can't be installed after downloading MySQL can't be installed after downloading Apr 08, 2025 am 11:24 AM

The main reasons for MySQL installation failure are: 1. Permission issues, you need to run as an administrator or use the sudo command; 2. Dependencies are missing, and you need to install relevant development packages; 3. Port conflicts, you need to close the program that occupies port 3306 or modify the configuration file; 4. The installation package is corrupt, you need to download and verify the integrity; 5. The environment variable is incorrectly configured, and the environment variables must be correctly configured according to the operating system. Solve these problems and carefully check each step to successfully install MySQL.

Unable to access mysql from terminal Unable to access mysql from terminal Apr 08, 2025 pm 04:57 PM

Unable to access MySQL from the terminal may be due to: MySQL service not running; connection command error; insufficient permissions; firewall blocks connection; MySQL configuration file error.

How to copy and paste mysql How to copy and paste mysql Apr 08, 2025 pm 07:18 PM

Copy and paste in MySQL includes the following steps: select the data, copy with Ctrl C (Windows) or Cmd C (Mac); right-click at the target location, select Paste or use Ctrl V (Windows) or Cmd V (Mac); the copied data is inserted into the target location, or replace existing data (depending on whether the data already exists at the target location).

How to pull the vertical reference line of PS How to pull the vertical reference line of PS Apr 06, 2025 pm 08:18 PM

Pull vertical guides in Photoshop: Enable ruler view (View > ruler). Hover the mouse over the vertical edge of the ruler, and then the cursor becomes a vertical line with double arrows and hold and drag the mouse to pull out the reference line. Click Delete by dragging the guide, or hovering it into a cross.

Can vs code run in Windows 8 Can vs code run in Windows 8 Apr 15, 2025 pm 07:24 PM

VS Code can run on Windows 8, but the experience may not be great. First make sure the system has been updated to the latest patch, then download the VS Code installation package that matches the system architecture and install it as prompted. After installation, be aware that some extensions may be incompatible with Windows 8 and need to look for alternative extensions or use newer Windows systems in a virtual machine. Install the necessary extensions to check whether they work properly. Although VS Code is feasible on Windows 8, it is recommended to upgrade to a newer Windows system for a better development experience and security.

See all articles