3

On Windows 7 I would like to enforce auditing on all subfolders and files for a specific local folder, by using the included Windows auditing features. When a user moves a file from the same NTFS volume into the folder that has auditing configured, the file does not inherit the audit settings because of the NTFS Move/Copy design feature/flaw (How to workaround the NTFS Move/Copy design flaw?). I have configured MoveSecurityAttributes (https://support.microsoft.com/en-us/kb/310316) which solves the problem for permissions but not for audit settings. Is there a similar setting as MoveSecurityAttributes that works for audit settings? Is there any way to enforce the audit settings for all subfolders and files? I am aware that it might be possible to make a script that resets the auditing settings. However the folder contains about one million files and the pc is shut down when it is not in use, so it seems not like a practical solution. Also it violates the goal of always having all files in the folder audited.

1
  • Not so much a fix as a workaround - if you have a dedicated volume with the auditing enabled from the root of the drive down this isn't an issue. Setting that option in conjunction with modify vs full control (for the permissions) has worked well for me over the years. Jul 12, 2016 at 18:42

0

You must log in to answer this question.

Browse other questions tagged .