Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today I received an email from one of my users asking why he couldn’t access his shared folder on one of our servers.

Example: \\servername\share\ = access denied.

When I checked the share permissions on the folder I was surprised to see that the user had been removed from the "shared permissions" list.

Now my question is: Is it possible to track who or what deleted the users share permissions on the folder?

I have studied the different event logs, but couldn’t find any indication of anyone who had changed the share permissions.

Kind Regards Martin

share|improve this question


Enable auditing in the local security policy on server servername. Select the Audit object access (success and failure) option in the audit policy.

cmd --> secpol.msc --> Local Policies ---> Audit Policy ---> Audit Object Access ---> change "Security Setting" from "no Auditing" to "Success, Failure"

There should be "Explain This Setting" tab for your reading


Configure the SACL on the \servername\share. Specify auditing of the Full Control permission for Everyone.

Right-click on folder in Windows Explorer ---> choose Properties --> tab Security ---> btn "Advanced..." --> tab Auditing

The auditing logs: eventvwr.msc --> Security

share|improve this answer
this will not work in retrospect btw – JamesRyan Jul 15 '10 at 13:20
Nothing will work in perspective also. Passive measure will always loose to active and persistent attempts by even unqualified people. It is possible only to speak about raising the cut-off level of difficulty which would cut the corresponding to its level qualified and patient people. BTW, there is sense of using a remote log server with all services shut off, allowing only console access – Gennady Vanin Геннадий Ванин Jul 15 '10 at 13:53

I suspect that changing share permissions is a use of a privilege. You can turn on privilege usage auditing.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.