Microsoft KB Archive/130892

= File Auditing Error in Windows NT 3.5 =

PSS ID Number: 130892

Article Last Modified on 10/30/2003

-

The information in this article applies to:


 * Microsoft Windows NT Workstation 3.5
 * Microsoft Windows NT Server 3.5

-



This article was previously published under Q130892



SYMPTOMS
Setting file auditing fails in Windows NT when you:


 * 1) Run User Manager and turn on auditing.
 * 2) Create a directory on a Windows NT file system (NTFS) partition.
 * 3) Create four or more subdirectories underneath the original directory.
 * 4) Select the third directory and deny access to everyone.
 * 5) Select the original directory and choose Auditing from the Security menu.
 * 6) Select Replace Auditing on Subdirectories, select Replace Auditing on Existing Files, and select any events to audit.
 * 7) Choose the Add button and then add Administrator.
 * 8) Choose OK to begin auditing the directories.
 * 9) You choose Yes when the "Access denied. Do you wish to continue?" error message appears.

If you select any directory past the third directory to see if auditing has been turned on, you see that it has not.



CAUSE
There is a problem in ACLEDIT.DLL that causes auditing to STOP when access is denied while setting auditing on directories.



WORKAROUND
To work around this problem, manually choose the directories to be audited.



STATUS
Microsoft has confirmed this to be a problem in Windows NT Workstation and Server version 3.5. This problem has been corrected in Windows NT Workstation and Windows NT Server version 3.51.

Additional query words: prodnt auditing

Keywords: KB130892

Technology: kbWinNT350search kbWinNTS350 kbWinNTS350search kbWinNTsearch kbWinNTSsearch kbWinNTW350 kbWinNTW350search kbWinNTWsearch

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© 2004 Microsoft Corporation. All rights reserved.