Solved

Windows Server 2008 File copy auditing

Posted on 2012-12-28
3
1,252 Views
Last Modified: 2012-12-28
Good morning,

I'm looking for a way, either natively or through 3rd party tools, to monitor when a file is copied from a share on my windows 2008 server share to another destination.  

My environment is a virtual desktop infrastructure on which I have a Windows 2008 R2 DC/File server with Windows Shares.  Also on the VDI are virtual Windows 7 computers which users log into via RDP through a gateway-to-gateway VPN tunnel.  All files are supposed to remain on the VDI but I need to know when a user copies files from the shares to another computer (either one of the virtual machines or, more importantly, a local computer from which they are working.  

After some Googling I'm not sure if this is even possible - hope someone can help.  

Thanks in advance!
0
Comment
Question by:ttist25
3 Comments
 
LVL 10

Accepted Solution

by:
George Khairallah earned 250 total points
ID: 38727965
I'm not sure that there is a way to enable copy audit, since a copy, to the source, will look like a  read/access, so unless you're monitoring a read/access of one file in the source, and write/modify of the same file at the destination, which would essentially comprise a "copy" action, you wouldn't be able to easily monitor that.

Perhaps if you're using VDI, you can isolate the VDI environment, for example? (of course I'm not sure whether you're ok with users copying other files, just not files from this one particular share? )
0
 
LVL 3

Assisted Solution

by:civicryan
civicryan earned 250 total points
ID: 38728313
I never try them but i did some research, you can call them for pre-Sales to be specific what you want.  It really hard to us to suggest you something that might not what you end up want so you can call their tech following suites:

ChangeAuditor for Windows File Servers
Windows File Server Auditing - by ManageEngine
Lastly, REAL-TIME AUDITING AND SECURITY COMPLIANCE FOR FILE SYSTEM - by BlackBird

Those are my suggestion for third parties softwares.
0
 
LVL 1

Author Comment

by:ttist25
ID: 38728532
Thanks for the responses guys.  I'm finding the about the same information.  It doesn't really look possible/feasible to monitor copying of files.  

I think the best bet, unfortunately, is going to be to lock it down completely.  

Thanks for the help.
0

Featured Post

Now Available: Firebox Cloud for AWS and FireboxV

Firebox Cloud brings the protection of WatchGuard’s leading Firebox UTM appliances to public cloud environments. It enables organizations to extend their security perimeter to protect business-critical assets in Amazon Web Services (AWS).

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Want Win 10 Pro to search like Server 2010 or 2012 27 106
windows 2008 installation hangs 13 38
Server 2008 Not services listed 23 44
NTP time source for DC 3 42
As cyber crime continues to grow in both numbers and sophistication, a troubling trend of optimization has emerged over the last year.
Many businesses neglect disaster recovery and treat it as an after-thought. I can tell you first hand that data will be lost, hard drives die, servers will be hacked, and careless (or malicious) employees can ruin your data.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

735 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question