How to audit file accesses on network drives for Windows environment.

Products

• CA Virtual Privilege Manager
• CA Privileged Identity Management Endpoint (PIM)
• CA Privileged Access Manager (PAM)

Issue/Introduction

How to audit file accesses on network drives for Windows environment.

Environment

CA Privileged Identity Manager for Windows

Resolution

Following rule achieves to audit file accesses on network drives.

 

AC> editres FILE ("\Device\Mup\;LanmanRedirector\;*") audit(a) defacc(a) owner(nobody)

 

seaudit shows resource names as follows.

 

\Device\Mup\;LanmanRedirector\;<Drive Letter>:<xxxxxxxxxx>\<remote host name>\<shared folder name>\<file-name or foldet-name>