How Windows XP prevents hackers (3)

Seventh, Folder Settings Audit

Windows XP can use audit trails to access user accounts, login attempts, system shutdowns or restarts, and similar events for files or other objects, while auditing files and Folders under the NTFS partition ensure the security of files and folders. The steps for setting up auditing for files and folders are as follows:

1) In the Group Policy window, expand the "Computer Configuration → Windows Settings → Security Settings → Local Policies" branch in the right window step by step, and then Under the branch, select the Audit Policy option.

2) Double-click the "Audit Object Access" option with the mouse in the right window.

3) Right-click on the file or folder you want to review, select the "Properties" command in the pop-up menu, and then select the "Security" tab in the pop-up window.
4) Click on the "Advanced" button and select the "Audit" tab.

5) Choose your action based on your situation:

If you want to set up a review for a new group or user, you can click the "Add" button and type a new user in the "Name" box. Name, then click the "OK" button to open the "Audit Project" dialog.

To view or change an existing group or user review, select the username and click the View/Edit button.

To delete an original group or user review, select the username and click the "Delete" button.

6) If necessary, select the location you wish to review in the "Apply to" list in the "Audit Project" dialog.

7) If you want to prevent files and subfolders in the directory tree from inheriting these audit items, select the "Apply these audit items only to objects and/or containers in this container" checkbox.

Note: A user who is a member of the Administrators group or who is authorized to have the Manage Auditing and Security Logs permission in Group Policy can audit files or folders. Before Windows XP audits files and folders, you must enable Audit Object Access for the Audit Policy in Group Policy. Otherwise, when you set up the file and folder audit, an error message will be returned, and the files and folders will not be reviewed.