[Autogenerated] Let's step into a critical topic of
auditing in the era of frequent data breaches.
Auditing has become indispensable.
These breaches can lead not to just data loss but also
damage to your company's reputation.
Another reason to focus on auditing is compliance standards.
Companies need to adhere to various regulations like GDPR or HIPA and a
robust auditing system can help you stay compliant with these.
And lastly, auditing plays a critical role in ensuring internal accountability.
It helps to identify who did what providing a clear detail work over
how to set up all this practically in a later demo,
you are part of an it team.
The company recently acquired another smaller
company as part of that acquisition,
that child's company resources and data need to be
integrated into your infrastructure.
One requirement is that the child's company's sensitive legal and
financial documents must be accessible only to certain executives
and legal team members at your company.
Your task is to create a new file share and a window server that will
store these documents set permissions to restrict access to only the
approved group with an active directory and enable auditing to track
those attempts unless dot Right.
Ended to creating a secure file share and setting up
auditing using nothing but PowerShell.
So I'm on my Windows machine with Parsa open as usual.
First things, first,
I need to create a folder that will contain our confidential files for that.
I'll use the new item command lit and the new item outlet
allows me to create a new folder or file.
In this case, I'm going to specify an item type of directory.
Now that the folder exists by default inherit
permissions from the parent folder.
We don't want that.
We need to lock this down using the NTFS security module I
already downloaded in the last demo.
I can clear all permissions from the folder and
disable inheritance all in one shot.
There we go.
Now that we're starting from a clean slate,
I can give the legal team ad group full control over that folder and Voila,
we are good to go now that access is restricted.
We need to enable auditing to log access attempts for that.
I'll use the command line utility called audit pole.
Unfortunately, there's no good way to do this with PowerShell.
The audit pull command allows you to view and configure
auditing policies via the command line.
So here I'm enabling, auditing for failed events within the handle manipulation.
That's the file handles and the file system audit subcategories.
These two categories are necessary to log denied file access attempts.
This should generate events when access is denied but this
just enables the policies we must now set auditing up on a
per folder basis to do that.
I can use the A NTFS audit command lett that's
available in the NTFS security module here,
I'm setting auditing on the legal Docs folder,
ensuring all denied attempts for my Atom user account
is recorded in the security Windows.
Event lock looks good, no errors so far.
So let's try it out.
So I'm running this PS console as the Atom account.
So let's just make sure.
Yep.
And now let's try to create a file inside of that folder and
we get denied exactly what we expected.
An event should have been recorded.
We could go clicking around in the event viewer,
but this is a power shaw course.
So let's use the Get wind event command lit using the Getin event command.
Let we can search for all event ID S matching 4656,
which should be event id logged for a denied file system
access attempt in the security even log great.
We got a bunch.
So I'm hoping that we should have got that one.
Looks like the top one.
There is 4:28 p.m. That is probably the one we want.
So let's filter this by the first one by piping it to
select the object and using the first one.
There we go.
And now let's expand the message property.
And now you can see that the subject account name was Adam,
the object name was test two,
the file that we attempted to create and the process name
that tried to do that was pwsh dot Xe, which is PowerShell.
So perfect.
We now have auditing set up.