Flooded with Event Id's 4663

[vane0326]

Hi,

I setup Track File Deletion on my Windows Server 2019 using this link below.

Eyonic's Weekly Tech Feed – 12 Sep 19

How to Track File Deletions on Windows Server Shares

This post explains how shared file deletions differ from other file deletions as well as how to set up auditing for file deletions from shared folders.

Since doing so, every second it reports that it has deleted ShadowCopy. It just filling it up and not easily scroll to look for actual users’ deletion events

Anyway I can have this not report to the event logs?

[vane0326]

I believe I found the ShadowCopy schedule. It’s located in Disk Management >> select disk >> properties >> Shadow Copies Tab.

It sets to start at 7am 5 days a week. But I still need to find on how not to report to the “File Deletion” in the event logs.

[rupesh-lepide]

You can check this article to exclude this from event logs windows server 2003 - Is it possible to filter out (remove) a single Event ID from the Event Viewer? - Server Fault

[vane0326]

Rupesh (Lepide):

You can check this article to exclude this from event logs windows server 2003 - Is it possible to filter out (remove) a single Event ID from the Event Viewer? - Server Fault

Thanks for replying.

I would like to exclude “SYSTEM” from reporting not filtering. These events are way too frequent - it deletes older events, so I’m not able to track down the other deletion events.

Anyway to exclude “SYSTEM” reporting to the event logs?

@rupesh-lepide

[rupesh-lepide]

For such customization, you need to try some third part automated solutions like Lepide File Server auditor .

[petersaraby]

vane0326:

Rupesh (Lepide):

@rupesh-lepide

You can check this article to exclude this from event logs windows server 2003 - Is it possible to filter out (remove) a single Event ID from the Event Viewer? - Server Fault

Thanks for replying.

I would like to exclude “SYSTEM” from reporting not filtering. These events are way too frequent - it deletes older events, so I’m not able to track down the other deletion events.

Anyway to exclude “SYSTEM” reporting to the event logs?

First off, you do not need to purchase a 3rd-party product in order to filter out audit events from the SYSTEM user account. In fact, auditing itself, the creation of events, is solely controlled by Windows and its auditing subsystem. 3rd party apps can potentially change auditing or collect, normalize etc. events, but only Windows controls what is logged.

Lucky for you, auditing in Windows is pretty granular, and you can control from which users you will and will not get audit events. You can most certainly exclude the SYSTEM user account from generating audit events. Where did you configure auditing on this system? Did you do that via group policy or did you just right-click the root of the C drive and enable auditing there (like below)?

Normally people just audit the “Everyone” built-in group since that ensures that all access to a folder is being audited, and that would of course include the SYSTEM account. An easy way to change this would be to specify which users you want to audit. If you have a group for all of your users (not “Domain Users” since that would include SYSTEM) then you could use that. Setting this up is a little tricky since you can’t just add an entry for SYSTEM that doesn’t audit anything, since the auditing should be accumulative and then still audit that.

Another approach would be to create a group in your domain or on the server (e.g. call it “Built-In Users”) and add the SYSTEM account to it. Then you can use conditions on the audit entry to NOT audit users that are part of that group.

Even though you technically don’t need a 3rd party solution for this, I would probably recommend looking into one. Some products can normalize those 4663 events so that you can view the reports that show you all access in a report format, not searching through hundreds of events in event viewer. I know that EventSentry has a feature for that, and it’s not expensive for a single server. But again, you are in control of auditing, any product you install will just make looking at the data easier.

Hope that helps.