Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Windows Server 2008 File copy auditing

Posted on 2012-12-28
3
Medium Priority
?
1,375 Views
Last Modified: 2012-12-28
Good morning,

I'm looking for a way, either natively or through 3rd party tools, to monitor when a file is copied from a share on my windows 2008 server share to another destination.  

My environment is a virtual desktop infrastructure on which I have a Windows 2008 R2 DC/File server with Windows Shares.  Also on the VDI are virtual Windows 7 computers which users log into via RDP through a gateway-to-gateway VPN tunnel.  All files are supposed to remain on the VDI but I need to know when a user copies files from the shares to another computer (either one of the virtual machines or, more importantly, a local computer from which they are working.  

After some Googling I'm not sure if this is even possible - hope someone can help.  

Thanks in advance!
0
Comment
Question by:ttist25
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 10

Accepted Solution

by:
George Khairallah earned 1000 total points
ID: 38727965
I'm not sure that there is a way to enable copy audit, since a copy, to the source, will look like a  read/access, so unless you're monitoring a read/access of one file in the source, and write/modify of the same file at the destination, which would essentially comprise a "copy" action, you wouldn't be able to easily monitor that.

Perhaps if you're using VDI, you can isolate the VDI environment, for example? (of course I'm not sure whether you're ok with users copying other files, just not files from this one particular share? )
0
 
LVL 3

Assisted Solution

by:civicryan
civicryan earned 1000 total points
ID: 38728313
I never try them but i did some research, you can call them for pre-Sales to be specific what you want.  It really hard to us to suggest you something that might not what you end up want so you can call their tech following suites:

ChangeAuditor for Windows File Servers
Windows File Server Auditing - by ManageEngine
Lastly, REAL-TIME AUDITING AND SECURITY COMPLIANCE FOR FILE SYSTEM - by BlackBird

Those are my suggestion for third parties softwares.
0
 
LVL 1

Author Comment

by:ttist25
ID: 38728532
Thanks for the responses guys.  I'm finding the about the same information.  It doesn't really look possible/feasible to monitor copying of files.  

I think the best bet, unfortunately, is going to be to lock it down completely.  

Thanks for the help.
0

Featured Post

Survive A High-Traffic Event with Percona

Your application or website rely on your database to deliver information about products and services to your customers. You can’t afford to have your database lose performance, lose availability or become unresponsive – even for just a few minutes.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
IF you are either unfamiliar with rootkits, or want to know more about them, read on ....
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question