Audit C:\Windows in Windows 7?

I have some contracts at work that require folder and file auditing be
enabled in C:\Windows and the subdirectories. I've been using Windowx
XP, but now we're moving to Windows 7. Microsoft has (finally!)
enabled good security by default, so I don't think I need to change
permissions. I am having problems enabling auditing, though.

If I enable auditing on C:\Windows using Windows Explorer, many of the
subfolders and files don't get the setting because inheritance has
been disabled. It's obviously impractical to change auditing using
Explorer on hundreds (thousands?) of folders and files on a whole
bunch of computers.

I've been writing my network administration scripts in PowerShell
lately, so that was an obvious choice for this project. However, when
I run Set-Acl, I get the error

Set-Acl : Attempted to perform an unauthorized operation.
At E:\Security Templates\Set-FileAudit.ps1:134 char:19
+                 $ACL | Set-Acl <<<<  $_.PSPath
    + CategoryInfo          : PermissionDenied: (C:\Windows\en-
US:String) [Set-Acl], UnauthorizedAccessException
    + FullyQualifiedErrorId :
System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetAclCommand

I quickly found out that my account (in the Administrators group) and
even the Administrator account don't have permissions to change
permissions on C:\Windows, or most of the critical subdirectories. I
also tried "Run as administrator", but that doesn't work either. The
script I wrote works fine in XP, so I know the logic is correct, it
just doesn't work in Windows 7 because of permission issues.

I am very reluctant to take ownership of the folders and files,
although I suspect if I take ownership I'd then be able to set the
audits I need. Since Microsoft has (finally!) enabled good security, I
believe taking ownership would reduce the security, so this is an
extremely poor option. On the folders I've checked, the owner is
TrustedInstaller, and I'd like to leave it that way.

So, how can I enable auditing on C:\Windows and it's subfolders and
files, even the ones which have inheritance disabled? As I stated
above, my PowerShell script works on XP, but not Windows 7.
0
Paul
4/27/2010 7:30:52 PM
windows.powershell 690 articles. 0 followers. Follow

1 Replies
1749 Views

Similar Articles

[PageSpeed] 32

"Paul Gibson" <gibson.pm@gmail.com> wrote:

[wants to set audit flags on files in Windows but nobody has the rights 
necessary to make the change]

> I am very reluctant to take ownership of the folders and files,
> although I suspect if I take ownership I'd then be able to set the
> audits I need. Since Microsoft has (finally!) enabled good security, I
> believe taking ownership would reduce the security, so this is an
> extremely poor option. On the folders I've checked, the owner is
> TrustedInstaller, and I'd like to leave it that way.
>
> So, how can I enable auditing on C:\Windows and it's subfolders and
> files, even the ones which have inheritance disabled? As I stated
> above, my PowerShell script works on XP, but not Windows 7.

I ran into a similar issue but on a more idiotic level: the prebuilt Themes 
in Windows 7 all quietly turn off the screen saver if it's not being 
configured by a domain GPO...and the files that define these themes have an 
ACL that does not allow any userid that's valid for an interactive logon to 
change them.

Like you I did not want to compromise the security settings.

My solution to this was to write a script that for every .THEME file:

* Save the current ACL
* Seize ownership
* Give ADMINISTRATORS full control
* Change the theme files to set PhotoScreenSaver.scr
* Restore the original ACL and owner

I could have noted the ACLs, done a mass foreclosure to seize ownership of 
the files, made the changes, and then applied the same ACL to all of the 
files but I didn't want to risk some future change to the permissions.  The 
result was a somewhat slow script, and doing that across the entire %WINDIR% 
tree would take a long time.  However...if this is done in the image from 
which multiple machines are built it would need to be done only once, and a 
slow process would not be that obnoxious.

Another possibility would be to write a program to run as a service (there 
are wrappers that make that rather easy), then install it as a service 
running in the "TrustedInstaller" context.  Not quite as straightforward as 
my script, and certainly less easy to describe to an ISSO, but that would 
run a lot faster since TrustedInstaller is the owner of the protected files.

I didn't use the service approach because I was designing a master build kit 
for use by the contractor responsible for preparing our distribution image 
files, and I don't want them mucking around in the service controls.  (Don't 
get me wrong; they're certainly competent in their area - but they shouldn't 
have to install a service and then remove it as part of the image build 
process.)

Joe Morris



0
Joe
4/28/2010 12:16:53 AM
Reply:

Similar Artilces:

How can I change the Z-axes of my window or dialog? #2
Hello, All: I am now meetting a problem that the sub-window( or sub-dialog) would not be shown out in front of the parent window, however, I just wanna let it be shown in front of my parent window. Is there anybody who knows how I can set the Z-axes with any function? Thanks in advance! ...

Renamed Windows 2003 Account
Hi My boss has got married, so i renamed her account to her new name, updated SMTP alias and set to primary. She can login and open outlook, but when sending emails, it is still sent in your old email address. Her new name can been seen in the global address book as well. Is it a matter of time for the sent from email name to automatically change to her new name? or is there another configuration i need to do? I am using Windows 2003 Domain controllers and 1 Exchanges 2003. regards If you open aduc under the general tab change the Display Name. If you are using cache Exch...

Install Money 2001 on Window XP
I installed Money 2001 on my new computer with Window XP. When I tried to run it, I got the error message:" Unable to initialize a reguired Money component. Please reinstall Money from your original product disks." Well, I did uninstall/ reinstall many times without luck. Why? Phil Hsu Are you using an administrator account to install it? See http://support.microsoft.com/default.aspx?scid=kb;en-us;266107&Product=mny too -- Glyn Simpson, Microsoft MVP - Money Check http://support.microsoft.com/default.aspx?scid=fh;EN-GB;mny for UK tips and fixes for MS Money. To send Mic...

How do I get a popup window on a VLOOKUP lookup failure?
I am using the VLOOKUP function and want to get an error indication if there is not an exact match for the first argument (lookup_value). I can get an error indication each cell with a problem by using the 4th argument to VLOOKUP and using the value "FALSE". How do I get a indication that there a problem in either a fixed location in the spreadsheet or a popop window? I am using Office 2003, but, if need be, I can move to Office 2010. I am using Windows XP and cannot upgrade. Assumes your lookup formula is in cell H4... Enter this formula in your "fixed location" cell:...

Windows update messed up
Code error 80070643 - no windows updates will install. I can't install anything else either. Had Visual Studio 2010 beta installed and can't uninstall/reinstall the new released version. Can't install latest iTunes 9.1.1 either. Says windows update service not availalbe. I've turned on the service but still nothing works. Done everything every other post/article says to do - still nothing. I'm not looiking forward to reinstalling Vista to solve this....thanks for your suggestions! I have a simmilar problem with all the latest updates for Microsft Fra...

Formatting problems on Mac Excel 2004 of Windows 2003 Spreadsheet
Spent last two days researching internet to try to find out why I'm having all this trouble getting my Windows 2003 Spreadsheets to print properly on a mac, using Windows Excel 2004. Comparing printouts of each: Mac seems to: 1: Interprete the font somewhat larger (20 %) 2: Displays and prints column positioning much larger (wider) Net result: Often 4 pages (2 wide, 2 high) instead of 1. The main usage of the (15) WorkBooks (each having at least 10 WorkSheets) is and will remain in the Windows environment. Therefore, I'm hoping there is a way to run the workbooks on ...

WIndows Xp 64 bit Service Pack
How many service packs are there for windows xp 64 bit "Tom_AF7J" wrote: > How many service packs are there for windows xp 64 bit Two. Two. Tom_AF7J wrote: > How many service packs are there for windows xp 64 bit ...

audit
For audits or other format, Is it poss to export the entire record to MS WORD Hi, By using a addon like the one of mscrm-addons, you can easily export all the columns to Word. For Auditing purposes I would recommend the addon by C360 though. Hope this helps, -- Ronald Lemmen - MSCRM MVP Avanade Netherlands http://www.ronaldlemmen.com/ "VP" wrote: > For audits or other format, Is it poss to export the entire record to > MS WORD > > ...

Windows XP messed up my Outlook 2000
After upgrading from Windws 98 to XP, MS Outlook 2000 stopped working. I don't have the install disks, or the product key. The rest of Office still functions normally, but Outlook keeps giving me these messages: -"Your computer has been upgraded from Windows 95 or 98 to a later version of Windows. Outlook must configure itself for this version of Windows". Then I click "OK" (only option), then next is... -"The feature you are trying to use is on a CD-ROM or other disk that is not availible. Insert the Microsoft Office 2000 SR-1 Professional disk and click OK...

excel #7
Hi everyone Can someone help me how to insert row simultaneously in 2 or more worksheets. If I insert a row in one worksheet than the other worksheet should also insert a row at the same location.. Thank you Gina Gina, Click the first worksheet tab (at the bottom of the screeen, maybe "Sheet1". THen ctrlclick the other worksheet (maybe "sheet3"). Now select a row, right click, insert...hope that's not too cryptic, don't know how experienced you are. HTH Beege. "GINA" <thisis@hotmail.com> wrote in message news:rj3ne.3239$cN2.1575@newsf...

Windows 2008 compatability
We have a customer who is looking to upgrade their server to Windows 2008 from Windows 2003. They are currently running GP 8.0. Is Windows 2008 compatable with that version of GP? The question is more, is GP 8 compatible with Windows 2008 and the answer is no. However, if you like the new brave world we live in, you can run GP 8.0 in Windows 2003 R2 compatibility mode while on Windows 2008. Best regards, -- MG.- Mariano Gomez, MIS, MCP, PMP Maximum Global Business, LLC http://www.maximumglobalbusiness.com The Dynamics GP Blogster at http://dynamicsgpblogster.blogspot.com "Susa...

HWND for the Main Window in MFC
This is a multi-part message in MIME format. ------=_NextPart_000_0028_01C3BDC0.CD4AAEA0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I'm creating a class in a header file for my MFC apps. I need to place a = messagebox in the class to display errors. The messagebox must be = attached to the main window in my dialog-based MFC app. However, the = MessageBox() function requires an HWND parameter to do this. The problem is that I don't know the HWND that would be associated with = the main dialog. I've searched though several...

Incoming mails lost in Windows Mail
Hi guys, I am using ver. 6.0.6000.16386 (vista_rtm.061101-2205). I have just had a test done and noticed that on my webmail from my provider there are 7 messages in the inbox. But when I download to Windows Mail, only 4 of the 7 actually come in!!? Is there a known bug or something (e.g. problem with the junkfilter?) There is no set rule from this sender and I have suspected since this several weeks now, so I would have noticed if a rule had misplaced them. Is there a logfile or something to look back on or a freeware tool I could download for diagnostics? This is my last ...

C# and XML Document
I am having problems with the following code. I am able to open the xml document and read it into memory and if I step through the code and look at the variables, I can see that the XML document is correct. What is happening is that what is being returned into TableName is "System.Xml.XmlElement" If I look at the variables in the autos window, I can see the following in InnerXML, <FOLDERNAME>Member</FOLDERNAME> etc. Folders = Doc.SelectSingleNode("SCHEMA").SelectSingleNode("FOLDER").SelectSingleNode("SUBFOLDERS").ChildNodes; TableLi...

Need formula in Excel to substract cell D from Cell C
Very simple question. I need the formula in Excel to substract cell D from cell C. I have worked with Lotus but not Excel before. Thank you. Louise In cell E1: =C1-D1 Make sure you preface your formula with the "=" sign so that Excel "knows" you're adding a formula, not just text... "Louise" wrote: > Very simple question. I need the formula in Excel to substract cell D from > cell C. I have worked with Lotus but not Excel before. > > Thank you. Louise In the cell you want the result type = then click on cell in C -(minus) cell in D...

C++ using Redemption
Is anyone aware of some sample C++ code using Redemption (http://dimastr.com/redemption/) on a Web site that I could look at. Thanks Tom G. ...

outlook.pst #7
When I try to send an e-mail with outlook express, I continuously receive an error message stating "cannot find outlook.pst" I have uninstalled and reinstalled outlook express 3 times and each time I still get the same warning. I can receive incoming messages but I cannot sent mail. Please help Thanx Do you have Outlook Express set as your default mail program in Control Panel | Internet Options | Programs tab? -- Jocelyn Fiorello MVP - Outlook *** Messages sent to my e-mail address will NOT be answered -- please reply only to the newsgroup to preserve the message thread. **...

Outlook 2000 SP3 and Windows 2000 Professional SP4
Just recently, Outlook 2000 is crashing on a user's PC. Here is the error from the applications event log; Source: Dr. Watson Event ID: 4097 Description: The application, ,generated an application error. The error occurred on 05/20/2004 @ 09:36:39:242. The exception generated was c0000005 at address 3AD852C8(<nosymbols>) After researching and reading the newsgroups, I have found 2 users that have reported this same error and so far no one has a possible solution to this. I have done all the same things as the other 2 users. uninstall/re-install office, reformated and re-ins...

How to bring the Excel window to the foreground?
Hi, I want to make the Excel window to be foreground. I created a VB6 form and use: Dim xlApp as Excel.Application set xlApp = getObject("", "Excel.Application") xlApp.Visible = true Then at some point I have to do Msgbox, however I have to bring my form to foreground or else it will be behind the excel window: FormFoo.setFocus Msgbox ("System msg") However I don't know how to bring up the Excel window again. I thought I could do xlApp.ActiveWindow.Activate (let's say only one excel window), but doesn't work. I know that I can get the hWnd value ...

Can I build COM add-in using C#
Can I build COM component add-in using C# instead of VB? When I build an add-in using C#, the compiler complains Session (object) does not contain a definition for 'Transaction' however, VB project build id successful. Please advise. P.S. I am a C# programmer, not VB. -- Thanks, -lz lzcouponex wrote: > Can I build COM component add-in using C# instead of VB? When I build an > add-in using C#, the compiler complains > Session (object) does not contain a definition for 'Transaction' > however, VB project build id successful. Yes.. you can, but for interoperab...

Multiple Extender Windows (one pop up, one not)
I am trying to set up two extender windows off of the sales order. One window will have mandatory customer order detail and will launch when the customer number is enetred. The other, has information for a specific customer-order type and I want them to be able to access it from the Additional menu. What is happenning, though, when I establish the two windows and set one to auto launch and one to be shortcut accessed, is both windows launch at the time I tab out of the customer field. Is there an easy way to segregate these windows or is this a natural shortcoming in Extender? Thanks f...

docked toolbar moves when resizing window slowly
I make a simple MFC SDI app with a docking toolbar and run it. No extras, completely standard. When I resize the window smaller, using the mouse dragging anywhere on the right hand edge, to the point where the right window edge meets the right edge of the toolbar and the slowly reverse the drag in the other direction so that the winodw is expanding it somehow catches the toolbar and drags this along with the the resize. It's as if you were dragging the toolbar by clicking on it but it's not clicked on. How do I prevent this unwanted behaviour? Thanks, Johnny "Johnny" &...

Sorting in Excel like in Window Explorer
Hello, I just extract a list of file names from a folder to an excel file. However, the sorting method in the Explorer is different from that in Excel, but I need print both of them in the same order. I need the excel files to check the copies printed from the files in the folders. There are handreds of files. The file names contain both number and letters, such as: DE032304NL0324. Is there any way to change the sorting methods in the Excel to the same as in the Windows Explorer? Thank you very much for you help in advance. Dolly - How are your files sorted in Ex...

Internet explorer 7 will error and close crm 3.0
What could cause this Under what circumstances does this occur ? If CRM always closes immediately then this due to pop-up blockers, otherwise can you post more information about the error and when it occurs -- David Jennaway - Microsoft Dynamics CRM MVP Web: http://www.excitation.co.uk "Mark" wrote: > What could cause this ...

upgrade path from Windows to Mac versions of Office
Is there an upgrade path from Windows to Mac versions of Office? I'm a licensed Word 10/XP user and am planning to switch from Windows to a MAC. Thanks, Kyle Kyle, There is no upgrade path from Windows to Macintosh versions of Office, nor from Macintosh to Windows. The most current version of Office for Macintosh is Office X. If you purchase Office X now, you will be entitled to Office 2004 for free when it is released later this year. This is called the "Technology Guarantee". You can find more information about it at the following web address: Technology Guarantee http://...