Tracking/Auditing file access and changes in server 2008

I have set up auditing on a folder on a Windows 2008 server. I see the events in the security event log. My question is can I set up a custom event item that just has the file access events without all the other security events? Or is there a 3rd party application that can better assist me in tracking and reporting file access and changes on this server.

We need to know:
Who accessed a file
When it was accessed
What canges were made if any
USGLOBALAsked:
Who is Participating?
 
JustMy2CentsCommented:
FileAudit will do the job for about $200 for one server.

This software solution allows you to:
- Monitor access (or access attempts) to files and folders stored on Windows systems
- Automatically archive all file access events occurring on one or several Windows systems for future reference
- Display file and folder access history in a printable report that can be scheduled to run automatically
- Export file and folder access history data to Excel for in-depth analysis and control

Detailed info and trial:
http://www.isdecisions.com/products/fileaudit/
0
 
npinfotechCommented:
0
 
USGLOBALAuthor Commented:
Looks nice but a minimum of 500 licenses.... Hmmm, pass. Appreciate the input though!

We just need to monitor one stand alone server and the file access.
0
 
npinfotechCommented:
Ouch, must be expensive.  

I don't think you can create custom events, but petri does a great job of explaining how to customize your event viewer views: http://www.petri.co.il/custom-event-views-in-windows-server-2008.htm.

This link describes more filtering options (it says it's for Vista, but it will work for server 2008):
http://www.petri.co.il/filtering-and-custom-views-in-vista-event-viewer.htm.

These should make it easier to find the needle in your haystack.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.