File Monitor and Setting correct permissions

[Ryuken]

Good evening

I´m having some issues with files in a file server, and maybe someone here can help me out with this:

1) First, I´d just like for someone to tell me if what I´m doing will have the result I expect it to have. I´m planning on setting folders permissions so that: a) A certain group will be able to create/change files within it; B) Although the group has write permissions, I want only the original file creator user to be able to rename or delete it. For that, I´m planning on setting the following:

- GROUP: Read/Write/Execute

- CREATOR OWNER: Modify/Read/Write/Execute

Will that work?

2) Someone knows some kind of file monitor for NTFS, that will log something like: which file was created/changed/deleted, when, where and by whom?

I thank you all in advance

[Ryuken]

Well, answering my own post:

1) It works right the way I wanted. That's less one problem :D

2) Still couldn't find a file monitor that does what I need.

[ɹəuəllıʍ ʇɐb]

Sorry for no replies; welcome to the Windows Forum anyway!

Glad you got your first issue resolved, but sorry I don't know of any file monitoring tool. I am sure though that it exists - I'm sure the need is there on many shared systems.

[Ryuken]

Thanks for the welcoming ^^

As for the File Monitor, perhaps I've found something.

My teacher showed it to me, in W2K3 Server, probably works for XP and 2000 Pro/Server as well.

Apparently, Windows Event Log System can audit changes in files and folders (although the log can be a bit confusing to read).

If I remember correct, all you have to do is:

1) Choose a folder/file to audit, go to Security Yab > Advanced > Auditing > Add. Set permissions the way you want (my needs call for a Everyone with all kinds of permissions - write, modify, and so on - both for Success and Failure).

That being done, go to Local Policies > Event Policy (not sure about this path, but what you'll want to do is change Event Policies). Then you just set System Event to log about everything. Open a command line and type gpupdate so it starts to work right away.

Like I said, doing it can be a little confusing, since a simple file creation may add about 20 lines to your System Log (when only one will showhe "File Createad"), but that's okay for a start, I hope :D

And Pat, don't worry about a thing. I guess that's more than natural when a post doesn't has any replies, mainly one like this one, which is asking for something that not everyone knows.

Well, I just hope that my doubts can be helpful to someone else out there.

[ɹəuəllıʍ ʇɐb]

If you are going to implement it, please post your results here. I find it very interesting that you can monitor files via event logs!