Solved

Who accessed my files

Posted on 2010-11-26
7
651 Views
Last Modified: 2012-05-10
I have an employee that has a shared folder on his Wndows Xp machine running in a Domain at work. He has shared the folders so that he can access them over the network when he uses a VPN connection to work from home. But now he finds out that some of his files has been accessed during the night and it has not been him. It says "Date accessed: 01:25".

Is there a way to find out which person/computer has accessed the files through some sort of log? Can there be anything else that has changed the access date for the files during the night, so that this is normal? Btw there is no antivirus og backup that has been scheduled to run at this particular insidence.

 
0
Comment
Question by:mintraas
  • 3
  • 2
  • 2
7 Comments
 
LVL 4

Accepted Solution

by:
delyan_valchev earned 500 total points
ID: 34216618
Hello,
You may want to turn on the access auditing on the particular shares or particular files. This way you will have the events logged to the Security event log.
Keep in mind that you need to enable the Audit object access setting in the local security policies (if not already defined through GPO). The setting is located in:
 Security Settings->Local Policies->Audit Policy->Audit object access
After that you can enable the auditing by setting the advanced security->auditing on the folders or individual files. If you are really paranoid, enable both success and failure auditing for Everyone on everything. This will have a hit on the performance and also quite some events will be overflowing the security log.

Hope it helps!
0
 

Author Comment

by:mintraas
ID: 34216792
Ok, so there is no way to see what has already happend to these files when this function is not turned on at the moment?
0
 
LVL 12
ID: 34216984
Bear in mind that AV scanning may affect the date accessed time.

Check to see if any scheduled scans are due to run at that time.
0
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 12
ID: 34216991
Note to self, please read all the way down the question next time!
0
 
LVL 4

Expert Comment

by:delyan_valchev
ID: 34217037
Unfortunately if you have no auditing enabled, you cannot see who or what exactly accessed the particular file. You can however check in the security log the time frame around 01:25 for any authentications from remote computers and/or users. This way you can only suspect someone.
0
 
LVL 4

Expert Comment

by:delyan_valchev
ID: 34217057
By the way another culprit may be a some indexing service like Windows Desktop Search or Google Desktop which indexes the supported files in the background. If there is such software installed it's likely to be the cause.
0
 

Author Closing Comment

by:mintraas
ID: 34217221
Thx. I configured, tested and it works.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Where can I find a virus scanner for XP SP2? 22 87
Windows XP under Hyper-V Server 2016 15 157
Windows 10 Errors 11 76
system default settings 4 26
Many businesses neglect disaster recovery and treat it as an after-thought. I can tell you first hand that data will be lost, hard drives die, servers will be hacked, and careless (or malicious) employees can ruin your data.
Do you know what to look for when considering cloud computing? Should you hire someone or try to do it yourself? I'll be covering these questions and looking at the best options for you and your business.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question