After many incidents of very important files deletion/corruption, I decided to enable auditing to record all changes made to files and who exactly accessed the files, and what actions did he make.
I am using Windows Server 2012 R2, I did some research to find how to monitor changes made to files, and made the following:
- Enabling Auditing through the Security tab of shared folder properties.
- Set the "Security" Log limit to 10GB, and Enabled archiving when full.
- After 1 years, I ended up with 10 files of logs with 100GB.
- When another deletion occurred, I had to open each file and filter on IDs 4663,4624,5140, and 4660. The files wouldn't load consuming a lot of RAM
- I tested on small files, it was not practical to filter, search and navigate
- I used Log Parser 2.2 to convert to CSV but there were no columns for the events details and the 'Description" column showed "The description for Event ID 4624 in Source "Microsoft-Windows-Security-Auditing" cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer"
My questions are:
- Is there a way to archive only specific events IDs?
- Can I archive/convert to CSV? Keeping all events details / Or any other format/viewer that is more practical, preferably open-source?
- Are the IDs 4663,4624,5140, and 4660 really accurate for deleted
files? - Is there a guide/manual to interpret logged events with regard to this specific purpose?