Active Directory Event ID's that Correspond to Remote File Access

Question

I am working with active directory logs generated on a large network with hundreds of AD servers. I am having trouble finding examples of active directory event IDs in the logs for a couple of basic network events.

What active directory event IDs correspond to

A) a network resource like a shared file being read/deleted/modified by a specific hostname. For example is something like user1 access spreadsheet1.csv on shared folder z://server1/share1

B) a network server has been accessed by a specific user. For example user1 logged into finance-server

Answer 1

That's because there are none. Those events do not show up in your Domain Controller Security logs for every member server in your domain. Could you imagine how crazy the logs would be on your DCs if every object access anywhere on the domain was logged by a domain controller? Or even worse, replicated to all domain controllers?

You can have object access auditing on a server, and object access will be logged on that server.

From there, you could then go crazy with event forwarding to get all those events from the different servers into a central location, but I would not recommend it for every single network access on your domain. Limit it to only the most sensitive files.

You can set object access auditing at the Local Security Policy on the server, or through Group Policy.