Unsolved
1 Rookie
•
24 Posts
0
504
SMB Audit File Share to see logon ids and source ip address
Hi, I have enabled audit object access and can see smb audit events but when a file is modified i see client logon id like this:
Client Logon ID: 0x7fe3dcde4348 - DESKTOP-3RVIHMV
I want to get the ip address of this client login, in windows file server i can enable Audit File Share and it will report this information logon id and source Address for that logon id.
How can I do the same in VNX as i dont see any option to Enable File Share like in windows.
DELL-Josh Cr
Moderator
Moderator
•
8.5K Posts
0
November 28th, 2022 08:00
Hi,
Thanks for your question. What version are you using? This article describes how to audit smb. https://dell.to/3F8xl6y
Let us know if there is anything else we can help you with.
alx123
1 Rookie
1 Rookie
•
24 Posts
0
November 30th, 2022 15:00
that document doesnt say anything about source ips of login sessions. it is Version 5.1.0
DELL-Sam L
Moderator
Moderator
•
6.9K Posts
0
December 1st, 2022 09:00
Hello alx123,
I am not seeing a way to get the source ip’s.
DELL-Josh Cr
Moderator
Moderator
•
8.5K Posts
0
December 1st, 2022 09:00
That document was for how to turn on auditing, if you have already done that it might not have that level of detail in the Windows logs if it isn’t in the event 5140 details. https://dell.to/3gPr8mO