I am running a users file share on
My concern is Domain Admins accessing someone's files they shouldn't.
I have turned on advanced auditing and tested the results. I see when someone does anything in the folder,
read/delete with the offenders
userid's but it comes across as
Event ID 5145.When the real user accesses their own folder, it also comes over as
Event ID 5145.
My place of work has over
4000 users so the option of alerting everytime someone uses their own files is not an option. I can't only trigger on failure since domain admins will have rights to access the files.
Placing "user's only" instead of users and admins is not an option since our backup's won't be able to read the data.
Anyone have any suggestions?