Tracking file permissions changes on a Windows server

The built-in auditing for permission changes is handled through "Audit object access". If you look at the types of auditing that you can configure on a filesystem object you'll see that "Change Permissions" is one of the auditable items.

You're going to find that the log data generated by "Audit object access" is painfully verbose and difficult to parse, though. The actual permissions change (a "WRITE_DAC" event-- DAC meaning "Discretionary Access Control") will only reference a handle ID, so you'll have to parse backwards from the WRITE_DAC to find the handle open event. That event will tell you the name of the object being modified by the WRITE_DAC. Rather tiresome...

I had one Customer who explored using the CPTRAX File System Audit Trails for Windows utility for a similiar situation. I don't believe they ever actually implemented it, but as part of their exploration I reviewed the documentation and found that it appeared to be "sane", at least. I can't give any kind of personal recommendation for it, but it looked like it would do what the manufacturer claimed.

Edit:

I had a few minutes tonight, so I wrote a crazy, painful CMD script to track permission changes. Parsing the event log is painful (and really requires a state machine to get it right), so this is a second-best attempt.

The script expects to be passed the filename of a file to track the permissions on, and a path and "base" filename of a file to store the permissions observed in. Let's assume a fake set of arguments: perm-track.cmd "C:\Program Files\Some Application\File To Track.exe" "C:\Permission Tracker\File to Track.exe"

The first time the script runs (at, say, 12:51:30 on July 18, 2010) the permissions set on "C:\Program Files\Some Application\File To Track.exe" will be stored in the file "C:\Permission Tracker\File to Track.exe.20100718_125130.permissions.txt".

The next time the script is run, with the same arguments, the permissions stored in the most recently-created "C:\Permission Tracker\File to Track.exe.*.permissions.txt" file will be compared against the current permissions on "C:\Program Files\Some Application\File To Track.exe". If there's a change, the new permissions will be stored in an appropriately named "File to Track.exe.ISODATE.permissions.txt" file in "C:\Permission Tracker".

Wiring this up to send emails would be pretty easy. Running it as a scheduled task, or in a loop would be pretty easy, too.

This is definitely quick-and-dirty, and it probably has bugs, but this script might do what you need.

@echo off

if "%~1"=="" goto syntax
if not exist "%1" goto syntax

if "%~2"=="" goto syntax

rem Get an ISO date (working around shell silliness re: hours earlier than 10:00)
SET YEAR=%DATE:~10,4%
SET MONTH=%DATE:~4,2%
SET DAY=%DATE:~7,2%
SET /A HOUR=%TIME:~0,2%
SET HOUR=0%HOUR%
SET HOUR=%HOUR:~-2%
SET MINUTE=%TIME:~3,2%
SET SECOND=%TIME:~6,2%
SET ISODATE=%YEAR%%MONTH%%DAY%_%HOUR%%MINUTE%%SECOND%

SET TEMPFILE="%TEMP%\%RANDOM%.TXT"

rem Save current permissions into a temporary file
cacls %1 >%TEMPFILE%

rem Get filename of last set of permissions reported
set LASTFILE=
for /f "usebackq delims=" %%f in (`dir /od /b /s "%~2*.permissions.txt"`) do SET LASTFILE=%%f

rem Was there no last file? If so, put current temp file in place
if "%LASTFILE%"=="" (
  move %TEMPFILE% "%~2.%ISODATE%.permissions.txt"
) else (
  rem Compare current permission to last permission-- if it's different, annotate current permission
  fc %TEMPFILE% "%LASTFILE%"
  if errorlevel 1 move %TEMPFILE% "%~2.%ISODATE%.permissions.txt"
)

goto end

:syntax
echo Really, really poor man's permission change tracker.
echo.
echo Call with path of file to monitor on command-line as first argument,
echo path and base filename to store "report" files of permission changes
echo as the second argument.
echo.
echo example:
echo.
echo   perm-track.cmd "C:\Program Files\Some Application\File To Track.exe" "C:\Permission Tracker\File to Track"
echo.

:end

Use a host based IDS, which is sometimes referred to as a filesystem IDS. I've used AIDE successfully against Windows before. It can be compiled with cygwin.

An alternative to AIDE is OSSEC, which appears to have a Windows port.

Varonis DatAdvantage for Windows is a great way to solve this issue. It monitors all file system events (create, open, delete, move, modify, permission change) and builds a searchable audit trail. You can setup recurring reports or real-time alerts based on trigger criteria, such as a permission change on your DC or when someone is elevated to Domain Admin.

Perhaps the best part is that DatAdvantage doesn't require native auditing (which can be slow and taxing) and never writes to disk on the servers that you monitor, so it's super low overhead.

(Disclosure: I work for Varonis, but wouldn't post this if I didn't think it were a fit.)