Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1907
  • Last Modified:

File and Folder Access Logging w/o Windows Auditing

I would like to know if there's some kind of software out there that logs file and folder read/write/changes and also gives me the NT user, time, and day of the change.  As I said in the title, i do not want to use NT auditing.  I want to log a folder on a NAS fileserver (with a dumbed down version of 2000 it seems) on a NT4 domain.  Thanks for any help!
1 Solution
Rich RumbleSecurity SamuraiCommented:
That's a tough one... if the folders and files resided on an FTP share you'd use the ftp log's but if it's an NT share then there are a few other 3rd party applications that can be installed to do this, the one that sprung to mind for me was NetAware http://www.infiltration-systems.com/netaware.shtml
Monitor Magic is another http://www.tools4ever.com/products/monitormagic/features/network-monitoring/connectivity-monitoring/
I dont know if this would work in your situation but you can try it for free:


Hope this helps.
jingalingAuthor Commented:
Thanks for the replies.  rich: netaware looks good but it does not log file creation and change which we need.  It just logs opens and closes (at least on my comptuer).  Monitor Magic doesn't seem to do this either.  gidds:  i've used GFI SELM and it is my backup choice because it runs on top of NT auditing.  Thanks for the suggestions though...keep em coming :)
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Rich RumbleSecurity SamuraiCommented:
If you like SELM then you may also like Snare: http://www.intersectalliance.com/projects/SnareWindows/index.html

There is a script that can be modified to alert you when a new file or folder is added to a directory... but it's not good enough for your purposes probably
see also http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/running_a_script_based_on_an_event.asp

The utils on this page may also help?

This would be easy with NT events.... grrrr:)

Oh yeah... don't know why I didn't think of it before... sysinternals!
Still these may not do all of what you ask
You could also take a look at File Audit its pretty basic but functional.


Rich RumbleSecurity SamuraiCommented:
I think my comments and links provide viable alternitives and a solution to the asker.

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now