Microsoft® Windows® Security: Essentials

Chapter 5

• Use Windows Explorer to create the folder, and then enable auditing on the folder using the steps in the “Enabling Object Access Auditing” section. Enable auditing in the Local Security Policy for Object Access auditing using the steps in the “Enabling Auditing” section.
• Launch the Event Viewer, and view the Security log.
• Follow the steps in the “Viewing Audit Information” section. When entering the event ID numbers, enter 4000-5000.
• Enable auditing in the Local Security Policy for successful system events. Launch the Event Viewer, and look for event ID 1102 in the Security log.