Where are the Audit Logs?

[jsteph]

Hi,
In both NT 4.0 and Win2k, I've set up Auditing on a folder, to track who's changing files in that folder. I was told those records go into the Event Log under Security, but no.

I was then told they go under winnt\system32\logfiles.

No. There are IIS logs there but that's it.

I tried to do a Search on all files accessed with the last few minutes (after changing a file in that folder, therefore forcing a log write), and the few files that look like likely candidates say 'Access Denied, the file may be in use'.

Can anyone tell me where they are? And how I can read them without shutting the machine down?
Thanks,
jsteph

 

[oisnds]

For the auditing to work you also need to activate it in for the local machine. When actived the entries show up in the security log.
In NT it is done in the User Manager, Policies on the menu and Auditing. Be sure to change to the local server if in a domain using the User menu.
In Windows 2000 use the Local Security settings in the Computer Administrator.