SMB
Audit and shadowing rights applicable to the SMB protocol:
•Audit: Connection - Enables the auditing of user attempts to access an SMB server. Also enables the auditing of attempts of other computers to gain access to shared network folders located on the computer running DeviceLock Service.
The following is written to the log: the Connection action and either the name or IP address of the SMB server to which access was requested, or the name or IP address of the computer that requested access to the computer running DeviceLock Service. To prevent the log cluttering by excessive number of connection-related records, only the first connection with the given SMB server or external computer is logged.
•Audit: Incoming Files - Enables the auditing of user attempts to download files from an SMB server. Also enables the auditing of attempts of other computers to upload files to shared network folders located on the computer running DeviceLock Service.
The Incoming File action and the name of each incoming file are written to the log.
•Audit: Outgoing Files - Enables the auditing of user attempts to upload files to an SMB server. Also enables the auditing of attempts of other computers to download files from shared network folders located on the computer running DeviceLock Service.
The Outgoing File action and the name of each outgoing file are written to the log.
•Shadowing: Incoming Files - Enables the shadow copying of files downloaded from SMB servers. Also enables the shadow copying of files uploaded by other computers to shared network folders located on the computer running DeviceLock Service.
A shadow copy of each incoming file is written to the log.
•Shadowing: Outgoing Files - Enables the shadow copying of files uploaded to SMB servers. Also enables the shadow copying of files downloaded by other computers from shared network folders located on the computer running DeviceLock Service.
A shadow copy of each outgoing file is written to the log.