Solved

Tracking user activity on a Small Business Server 2003 network

Posted on 2008-10-13
2
1,065 Views
Last Modified: 2012-05-05
I've been asked to track through the system and find out from the logs when a user has logged on and off since 15th. September.  I'm also increasingly getting requests to find out what files have been modified by particular users, etc.  Can anybody recommend how I would go about monitoring all the network activity, and if there's anything I can use to search through the volumes of activity that would be generated?  Also, are there any settings that aren't turned on by default in SBS 2003 that I could switch on?
0
Comment
Question by:Techdivision
2 Comments
 
LVL 95

Accepted Solution

by:
Lee W, MVP earned 250 total points
ID: 22708160
You can look into the event logs on the workstation for when they logged on and off.  Otherwise, to track file usage, you would need to enable auditing.  Even then, Auditing only provides basic information.  Depending on how serious you are about tracking activity, you may be better off using a product like DeviceLock - www.devicelock.com which can track with fine detail many activities and prevent (or make VERY difficult) unauthorized activities involving copying, etc.
0
 
LVL 38

Assisted Solution

by:Philip Elder
Philip Elder earned 250 total points
ID: 22714199
Enable Group Policy object level auditing:
http://technet.microsoft.com/en-us/library/cc757864.aspx
You can audit access to files, folders, registry keys, and system services.
Keep in mind that the auditing process can be CPU intensive ... so balance what you want audited with the server's capabilities.
Philip
0

Featured Post

Superior storage. Superior surveillance.

WD Purple drives are built for 24/7, always-on, high-definition security systems. With support for up to 8 hard drives and 32 cameras, WD Purple drives are optimized for surveillance.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the event you manage a Small Business Server 2003, and you are audited for PCI compliance, there are several changes you must make in order to pass the audit. I can take no credit for discovering any of these fixes or workarounds, but there is no…
Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now