Hi,
I have enabled directory/file auditing on a Windows 2003 server. There is a Microsoft Access database that repeatedly gets set to read-only which keeps users from being able to access it.
I've gone through several articles such as this:
http://support.microsoft.com/kb/300549
but none of them go into details about what to look for when diving into the event log. I've pulled thousands of lines relating to access of this file, but they all look the same.
I even just cleared the event log, set the file to read only, then cleared the flag, and exported the event log. There are still hundreds of events that are of type 560. I've searching through and I can't determine any difference between them.
Can someone tell me what specifically to look for in the event log when a file is set to read-only?
Thank you!
--Kent