Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

During an overnight system state backup we are seeing thousands of success audit events (4656, 4658) on the folder c:\windows\servicing, system32 and others in the windows folder.

We use file success auditing on some files so I can't disable it but this deluge is filling up the logs and making reporting tricky.

What is the harm of changing the auditing settings on the windows folder?

What are the recommended settings to put on the files for those people doing system state backups?

Thanks,

share|improve this question

1 Answer 1

up vote 1 down vote accepted

As far as I know, windows 2008 does not directly rely on the auditing tool for any out of the box system functionality. In other words, changing the settings should not have any side effects.

If you've enabled the auditing settings, then you must have a list of requirements for it - you must be relying on the audits for some purpose, and have a set of requirements in terms of what is logged and what is not logged. Use that information to decide what to log, and when.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.