I need to know who last modified or created a file on a Microsoft based machine or Network share. For instance, someone installed a program on my server and all my helpdesk technicians claim ignorance. Another example: I get a call from a user who wants to know the person that last modified an Excel Spreadsheet on a Microsoft Network shared drive.
I know of Microsoft object auditing but for obvious reasons this method is impractical for monitoring thousands of files.
I have seen this work on a Netware based network but since we migrated to Windows Server I have not seen anything close to it.