Hello,

I've enable object access success audit for a folder in Windows 2003 and
I'm having the following problem, every time a user has success opening
a folder, many identical Object Open Events (560) are being generated
for the same user/folder.
Is this normal behaviour? Is there a way to filter this within
Sentinel?

I'm using snare agent for syslog.

Thanks in Advance


--
mmarchese
------------------------------------------------------------------------
mmarchese's Profile: https://forums.netiq.com/member.php?userid=1311
View this thread: https://forums.netiq.com/showthread.php?t=52599