When were the permissions on that folder changed? Who added Bob the mailroom guy to the Purchasing Agents group?!?
I'll show you how to answer those questions using Account Management and Object Access events from the Windows security log for both Windows Server 2003 and 2008.
In this webinar I will perform live demos on both 2003 and 2008 systems. In the demos I will show you how to set up auditing to catch these access control changes and then I'll perform some example permission and group changes and show you the resulting events on both versions of Windows - as you know, the event IDs on Windows Server 2008 are totally different than 2003.
I will also make sure you understand which systems' security logs you have to review in order to make sure you don't miss any access control changes including domain groups, machine local groups and modifications to access control lists.
After my presentation you'll hear from AlertLogic which is a unique log management SERVICE - NOT SOFTWARE which I think is pretty cool. AlertLogic will demonstrate how they can help you collect and analyze these access change events without installing software or the associated care and feeding.