I was wondering if anybody has any pointers on how to do "detailed" folder auditing. I am aware of enable object auditing policies and setting up Change Permission and Take Ownership on the actual folder. I am interested in determining "who" granted/revoked "what" to "whom" and "when".
So if an IT admin grants permission to a folder to a user, I'd like to be able to see the details of that activity in the event log (Windows 2003). I currently see events 560, but this only tells me a DAC was changed... how do I monitor the details of what was changed via the event log and my SIEM?
Thanks!