Tracking/Auditing file access and changes in server 2008
I have set up auditing on a folder on a Windows 2008 server. I see the events in the security event log. My question is can I set up a custom event item that just has the file access events without all the other security events? Or is there a 3rd party application that can better assist me in tracking and reporting file access and changes on this server.
We need to know:
Who accessed a file
When it was accessed
What canges were made if any
We need to know:
Who accessed a file
When it was accessed
What canges were made if any
npinfotech
great tool: http://www.quest.com/access-manager/
ASKER
Looks nice but a minimum of 500 licenses.... Hmmm, pass. Appreciate the input though!
We just need to monitor one stand alone server and the file access.
We just need to monitor one stand alone server and the file access.
Ouch, must be expensive.
I don't think you can create custom events, but petri does a great job of explaining how to customize your event viewer views: http://www.petri.co.il/custom-event-views-in-windows-server-2008.htm.
This link describes more filtering options (it says it's for Vista, but it will work for server 2008):
http://www.petri.co.il/filtering-and-custom-views-in-vista-event-viewer.htm.
These should make it easier to find the needle in your haystack.
I don't think you can create custom events, but petri does a great job of explaining how to customize your event viewer views: http://www.petri.co.il/custom-event-views-in-windows-server-2008.htm.
This link describes more filtering options (it says it's for Vista, but it will work for server 2008):
http://www.petri.co.il/filtering-and-custom-views-in-vista-event-viewer.htm.
These should make it easier to find the needle in your haystack.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.