Computer Configuration | Policies | Windows Settings | Security Settings | Advanced Audit Policy Configuration | Audit Policies | Object Access | Audit File System.Computer Configuration | Policies | Windows Settings | Security Settings | Local Policies | Audit Policy | Audit Object Access.In the local policy (or applicable GPO) of the computer, enable Success audits via one of the following:.To use auditing, you'll need to do the following: The benefits of using Procmon are that it is simple to download and run with little preconfiguration at the expense of needing to keep it running at all times. If this needs to be long-running, you most likely want to enable the "Drop Filtered Events" option on the Tools menu. Again use the "is" condition, however you can use the "begins with" condition if you want to see ACL changes to sub folders. If your path is c:\path\to\temp, enter that. Path: Set this to the path to your temp folder.This will show you any event in which an ACL is modified on a file or directory.
Operation: filter for SetSecurityFile (use the "is" condition). Using Procmon, you want to set filters for the following: 
If you would like to save the logs, you can by going to File -> Save.You have two options, depending on your preference or specific needs: Procmon. Once you find the errors, determine if they are relevant to your issue. Please take notes of any warnings or errors. The first thing you should do when examining the logs is to see if anything in the “Result” column is not “SUCCESS”. Once the error occurs, go back to ProcMon and click the Capture Icon to stop capturing events. Go to your web application and trigger the error. There should NOT be a red “X” through it. Please make sure that the Capture icon (shaped like a magnifying class) is enabled. Click “Apply” and then “OK” to exit the Dialog. Create a rule that says “Process Name is w3wp.exe”. 
Add the w3wp.exe process to the filter by going to Filter -> Filter…. Reset the filter by clicking Filter -> Reset Filter. You need to be easily able to trigger the event that causes the error while ProcMon is running to avoid collecting too much information. Go to the page in your web application before your error occurs.
0 kommentar(er)
