Solved

Windows Server 2008 File copy auditing

Posted on 2012-12-28
3
1,209 Views
Last Modified: 2012-12-28
Good morning,

I'm looking for a way, either natively or through 3rd party tools, to monitor when a file is copied from a share on my windows 2008 server share to another destination.  

My environment is a virtual desktop infrastructure on which I have a Windows 2008 R2 DC/File server with Windows Shares.  Also on the VDI are virtual Windows 7 computers which users log into via RDP through a gateway-to-gateway VPN tunnel.  All files are supposed to remain on the VDI but I need to know when a user copies files from the shares to another computer (either one of the virtual machines or, more importantly, a local computer from which they are working.  

After some Googling I'm not sure if this is even possible - hope someone can help.  

Thanks in advance!
0
Comment
Question by:ttist25
3 Comments
 
LVL 10

Accepted Solution

by:
George Khairallah earned 250 total points
ID: 38727965
I'm not sure that there is a way to enable copy audit, since a copy, to the source, will look like a  read/access, so unless you're monitoring a read/access of one file in the source, and write/modify of the same file at the destination, which would essentially comprise a "copy" action, you wouldn't be able to easily monitor that.

Perhaps if you're using VDI, you can isolate the VDI environment, for example? (of course I'm not sure whether you're ok with users copying other files, just not files from this one particular share? )
0
 
LVL 3

Assisted Solution

by:civicryan
civicryan earned 250 total points
ID: 38728313
I never try them but i did some research, you can call them for pre-Sales to be specific what you want.  It really hard to us to suggest you something that might not what you end up want so you can call their tech following suites:

ChangeAuditor for Windows File Servers
Windows File Server Auditing - by ManageEngine
Lastly, REAL-TIME AUDITING AND SECURITY COMPLIANCE FOR FILE SYSTEM - by BlackBird

Those are my suggestion for third parties softwares.
0
 
LVL 1

Author Comment

by:ttist25
ID: 38728532
Thanks for the responses guys.  I'm finding the about the same information.  It doesn't really look possible/feasible to monitor copying of files.  

I think the best bet, unfortunately, is going to be to lock it down completely.  

Thanks for the help.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article outlines the process to identify and resolve account lockout in an Active Directory environment.
Each year, investment in cloud platforms grows more than 20% (https://www.immun.io/hubfs/Immunio_2016/Content/Marketing/Cloud-Security-Report-2016.pdf?submissionGuid=a8d80a00-6fee-4b85-81db-a4e28f681762) as an increasing number of companies begin to…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question