What files were accessed

pma111
pma111 used Ask the Experts™
on
Is there anyway to see what files on a file share a user accessed on a given day? If so can you describe the tools/techniques used to get this information? 2003 server. From an XP machine. If we cant get a full audit trail just some idea of what files were accessed would help.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
You will need to enable auditing through the local group policy.

gpedit.msc -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy -> Audit object access

Next audit your folder.

right-click the folder -> Properties -> Security tab -> Advanced -> Auditing tab -> Edit -> Add -> type everyone and click OK -> Click Successful and Failed for Full Control -> OK -> OK -> OK

Now, you have a full audit trail for a folder.
Commented:
And ofcourse you can use something like ChangeAuditor from quest which does the same but you have to pay for it.

Author

Commented:
So unless auditing is switched on there is absolutely nothing on either the desktop or the server to show what files they accessed.
Exactly. Auditing is always an aspect overlooked until something happens.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial