asked on

Determine who moved a file

My office has a network share with several files and folders. We are running windows 2011 SBS with a domain and every employee has their own user name and password.
Someone in the company is moving files from one folder to another. Is there any way to determine which user(username) is moving files? I know how to determine who the owner is but I would like to know who the last person was that moved the files.

Mike Kline

It is a multistep process you have to enable auditing and then also turn it on for that file/folder. I don't use SBS so I can't take screenshots there but here are some from a regular Windows Server

http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access

It should be similar.

Thanks

Mike

fastteks0390

ASKER

and as far as reviewing it after something occured?

Will Szymkowski

When you have the local policies created for Auditing you need to reference the "Security" logs for all Audit entries. It is good to ensure that you do not audit an entire drive and only specific folders because this will put a taxation on the servers performance and also fill up your logs very quickly.

hope this helps

ASKER CERTIFIED SOLUTION

Sandesh Dubey

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

reynoldsradisson

The only solution is to get a real time alerts monitoring. This would enable you to get an aware about the knowledge who so ever have deleted the files and folder. This link would help you a lot..

http://social.technet.microsoft.com/Forums/windowsserver/en-US/b18ca99b-db07-4e2e-8f13-67d58a4d1c63/windows-2008-server-files-access-real-time-monitoring

Thanks.