Pau Lo
asked on
local clues for files share access
What kind of history/evidence would their be locally on an XP machine of accessing files on a network file share? If any? I did some reading on *.lnk files, but I assume they'd be on the share itself not the client PC? Any other potential areas to investigate...
Have you tried event viewer?
ASKER
Any specific event evt file?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hmmm that log (if its security.evt) is empty!
Can you populate it with an event? Try connecting to another computer and refreshing the screen.
Also you can go to Start->Run->"services.msc" and check if "Windows Event Log" has been turned off.
Also you can go to Start->Run->"services.msc"
ASKER
I can't do as you say as we just have a replica copy of the drive. Local security policy which has an auditing section states no auditing to the 6 or so options.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks Ken, appreciate the pointers...
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.