Tracking user activity on a Small Business Server 2003 network

I've been asked to track through the system and find out from the logs when a user has logged on and off since 15th. September.  I'm also increasingly getting requests to find out what files have been modified by particular users, etc.  Can anybody recommend how I would go about monitoring all the network activity, and if there's anything I can use to search through the volumes of activity that would be generated?  Also, are there any settings that aren't turned on by default in SBS 2003 that I could switch on?
TechdivisionAsked:
Who is Participating?
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
You can look into the event logs on the workstation for when they logged on and off.  Otherwise, to track file usage, you would need to enable auditing.  Even then, Auditing only provides basic information.  Depending on how serious you are about tracking activity, you may be better off using a product like DeviceLock - www.devicelock.com which can track with fine detail many activities and prevent (or make VERY difficult) unauthorized activities involving copying, etc.
0
 
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Enable Group Policy object level auditing:
http://technet.microsoft.com/en-us/library/cc757864.aspx
You can audit access to files, folders, registry keys, and system services.
Keep in mind that the auditing process can be CPU intensive ... so balance what you want audited with the server's capabilities.
Philip
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.