ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Tracking user steps on files

    IT Discussion
    8
    12
    1.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JoelJ
      Joel
      last edited by

      I've been asked if its possible to view a log of file changes. eg. logs of when and who opens/reads/deletes/copies files within a folder on the server.

      Is this possible perhaps via event viewer or other?
      We have a single File Server with Domain Controller. All users authenticate to the server so wanted to know if there is some way we can monitor or check who has accessed what etc.

      Thoughts appreciated.

      1 Reply Last reply Reply Quote 1
      • gjacobseG
        gjacobse
        last edited by

        Server details?

        OS version?

        JoelJ 1 Reply Last reply Reply Quote 0
        • crustachioC
          crustachio
          last edited by crustachio

          Windows file and object audit policies.

          • https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/

          • https://technet.microsoft.com/en-us/library/dd277403.aspx

          • https://community.spiceworks.com/how_to/122828-how-to-enable-file-and-folder-access-auditing-on-windows-server-2008-and-2008-r2

          1 Reply Last reply Reply Quote 1
          • JoelJ
            Joel @gjacobse
            last edited by

            @gjacobse said in Tracking user steps on files:

            Server details?

            OS version?

            Windows Server 2012 R2

            scottalanmillerS 1 Reply Last reply Reply Quote 0
            • DustinB3403D
              DustinB3403
              last edited by

              @crustachio has the answer you need.

              Although I don't know how you'd be able to get copy records....

              crustachioC 1 Reply Last reply Reply Quote 0
              • crustachioC
                crustachio @DustinB3403
                last edited by

                @DustinB3403 said in Tracking user steps on files:

                @crustachio has the answer you need.

                Although I don't know how you'd be able to get copy records....

                Not natively. Possibly with third party tools but it's not surefire.

                1 Reply Last reply Reply Quote 0
                • scottalanmillerS
                  scottalanmiller @Joel
                  last edited by

                  @Joel said in Tracking user steps on files:

                  @gjacobse said in Tracking user steps on files:

                  Server details?

                  OS version?

                  Windows Server 2012 R2

                  Audit records will tell you everything that can be told. Copy, however, doesn't have an "action" with it so there is no means of tracking that. The server isn't told when a copy is made, so there is no way to log that.

                  J 1 Reply Last reply Reply Quote 0
                  • S
                    Shuey
                    last edited by

                    Depending on how important it is to management, and how much money they might be willing to spend, Netwrix Auditor can track all of the information you're wanting to track, and then some.

                    1 Reply Last reply Reply Quote 0
                    • J
                      joelbarlow40
                      last edited by joelbarlow40

                      You need to first enable auditing of object access --> Whichever Top Level Policy--> Computer Configuration--> Windows Settings--> Security Settings-->Local Policies-->Audit Policy-->Audit Object Access - you can enable success/failure.

                      1 Reply Last reply Reply Quote 0
                      • J
                        Jimmy9008 @scottalanmiller
                        last edited by

                        @scottalanmiller said in Tracking user steps on files:

                        @Joel said in Tracking user steps on files:

                        @gjacobse said in Tracking user steps on files:

                        Server details?

                        OS version?

                        Windows Server 2012 R2

                        Audit records will tell you everything that can be told. Copy, however, doesn't have an "action" with it so there is no means of tracking that. The server isn't told when a copy is made, so there is no way to log that.

                        Will that record access if say, viewed in preview pane, rather than opened fully? Would be good to setup prtg to look in event log for that on specific files, if possible.

                        scottalanmillerS 1 Reply Last reply Reply Quote 0
                        • S
                          Shuey
                          last edited by

                          If you're looking for something free, does this fit the bill?
                          http://www.nirsoft.net/utils/folder_changes_view.html

                          1 Reply Last reply Reply Quote 0
                          • scottalanmillerS
                            scottalanmiller @Jimmy9008
                            last edited by

                            @Jimmy9008 said in Tracking user steps on files:

                            @scottalanmiller said in Tracking user steps on files:

                            @Joel said in Tracking user steps on files:

                            @gjacobse said in Tracking user steps on files:

                            Server details?

                            OS version?

                            Windows Server 2012 R2

                            Audit records will tell you everything that can be told. Copy, however, doesn't have an "action" with it so there is no means of tracking that. The server isn't told when a copy is made, so there is no way to log that.

                            Will that record access if say, viewed in preview pane, rather than opened fully? Would be good to setup prtg to look in event log for that on specific files, if possible.

                            It should has it has to open it for that.

                            1 Reply Last reply Reply Quote 0
                            • 1 / 1
                            • First post
                              Last post