• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1912
  • Last Modified:

File and Folder Access Logging w/o Windows Auditing

I would like to know if there's some kind of software out there that logs file and folder read/write/changes and also gives me the NT user, time, and day of the change.  As I said in the title, i do not want to use NT auditing.  I want to log a folder on a NAS fileserver (with a dumbed down version of 2000 it seems) on a NT4 domain.  Thanks for any help!
1 Solution
Rich RumbleSecurity SamuraiCommented:
That's a tough one... if the folders and files resided on an FTP share you'd use the ftp log's but if it's an NT share then there are a few other 3rd party applications that can be installed to do this, the one that sprung to mind for me was NetAware http://www.infiltration-systems.com/netaware.shtml
Monitor Magic is another http://www.tools4ever.com/products/monitormagic/features/network-monitoring/connectivity-monitoring/
I dont know if this would work in your situation but you can try it for free:


Hope this helps.
jingalingAuthor Commented:
Thanks for the replies.  rich: netaware looks good but it does not log file creation and change which we need.  It just logs opens and closes (at least on my comptuer).  Monitor Magic doesn't seem to do this either.  gidds:  i've used GFI SELM and it is my backup choice because it runs on top of NT auditing.  Thanks for the suggestions though...keep em coming :)
Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

Rich RumbleSecurity SamuraiCommented:
If you like SELM then you may also like Snare: http://www.intersectalliance.com/projects/SnareWindows/index.html

There is a script that can be modified to alert you when a new file or folder is added to a directory... but it's not good enough for your purposes probably
see also http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/running_a_script_based_on_an_event.asp

The utils on this page may also help?

This would be easy with NT events.... grrrr:)

Oh yeah... don't know why I didn't think of it before... sysinternals!
Still these may not do all of what you ask
You could also take a look at File Audit its pretty basic but functional.


Rich RumbleSecurity SamuraiCommented:
I think my comments and links provide viable alternitives and a solution to the asker.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now