IFsrmSetting::EnableScreeningAudit property

Retrieves or sets a value that determines whether FSRM keeps audit records of the file screen violations.

This property is read/write.

Syntax


HRESULT put_EnableScreeningAudit(
  [in]  VARIANT_BOOL enableScreeningAudit
);

HRESULT get_EnableScreeningAudit(
  [out] VARIANT_BOOL enableScreeningAudit
);

Property value

Set to VARIANT_TRUE to maintain audit records for file screen events; otherwise, VARIANT_FALSE. The default is VARIANT_FALSE.

Error codes

The method returns the following return values.

S_OK

Success

Remarks

The records are included in a File Screen Audit report. An audit record contains the following items:

  • Folder path
  • Id
  • Blocked file group name
  • File screen mode
  • Time stamp of when the violation occurred
  • The name of the process image that generated the prohibited IO, if available
  • The SID of the user principal that issued the prohibited IO, if available
  • The full path of the prohibited file
  • The server name

If this property is false and a report specifies the FsrmReportType_FileScreenAudit report type, the report will succeed but will not contain any audit information (or will contain audits that were done before auditing was disabled).

Examples

For an example, see IFsrmSetting.

Requirements

Minimum supported client

None supported

Minimum supported server

Windows Server 2008

Header

Fsrm.h (include FsrmPipeline.h, FsrmQuota.h, FsrmReports.h, FsrmScreen.h, or FsrmTlb.h)

DLL

SrmSvc.dll

CLSID

CLSID_FsrmSetting is defined as f556d708-6d4d-4594-9c61-7dbb0dae2a46 (Defined in FsrmTlb.h)

IID

IID_IFsrmSetting is defined as f411d4fd-14be-4260-8c40-03b7c95e608a

See also

IFsrmSetting
FsrmSetting

 

 

Show: