Windows 2008r2 - Who created the shares?

Is there a way to tell who created shares on a server?  If so, how?  We have some rouge admins that share with the everyone group instead of authenticated users.
LVL 2
BrianRBAsked:
Who is Participating?
 
GeodashConnect With a Mentor Commented:
I know its a shot in the dark but I use this on a couple file servers.

It does full auditing of file servers and shares. Its not free and wont give you any historical information, but if it is something you want to manage in the future - well worth the money!

http://www.scriptlogic.com/products/enterprisesecurityreporter/
0
 
doublestickCommented:
maybe the event logs?
0
 
motnahp00Commented:
If you have auditing enabled you can search the event logs to see modifications made to objects (Audit object access).
0
The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

 
BrianRBAuthor Commented:
God that would take forever to go through would it not?
0
 
motnahp00Commented:
Not necessarily. Create a filter and configure the following:

Logged: your timeframe you want query
Event sources: Microsoft Windows security auditing
Task category: File System

This should save you some time.
0
 
BrianRBAuthor Commented:
Great one!!  Doesn't look cheap though. :(
0
 
GeodashCommented:
Its not super expensive mine were $500 per server. You can download a free 30 day fully functional eval too.
0
 
BrianRBAuthor Commented:
SERIOUSLY?  Ok, that is cheap.  Works well?  You like it?
0
 
GeodashCommented:
Absolutely love it! But, get the trial first. Try it to make sure it will work for you. Full 30 day fully functional!
0
All Courses

From novice to tech pro — start learning today.