Solved

Is there a way to track files copied from file server

Posted on 2014-09-24
7
1,256 Views
Last Modified: 2014-10-11
Hello EE,

I have a very unique issue.  I have a situation where I have users who are accessing files on our file server.
1. I can see files open from manage.

My question is can I monitor if a user is copying files from the file server to their machine, USB, whatever media?
0
Comment
Question by:operationsIT
  • 4
  • 3
7 Comments
 
LVL 119
ID: 40341777
You need to turn on Auditing. (both on the file server and workstation).
0
 

Author Comment

by:operationsIT
ID: 40346033
Can you set Auditing via GPO that would roll out to everyone?
0
 
LVL 119
ID: 40346052
Yes, GPO can be used to change Auditing.
0
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 

Author Comment

by:operationsIT
ID: 40357802
My Files are stored on a NetAPP and what I'd like to accomplish is for a group of x number of people to track:
1. What files are touched
2. If any files are copied.
0
 
LVL 119
ID: 40358009
I would look at AD Audit Plus

http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html

A fully functional 30 day trial is available to Audit CIFS shares on the NetApp Filer, files copied to and from the NetApp CIFS Shares.
0
 

Author Comment

by:operationsIT
ID: 40366729
I know you can enable access policy in GPO and then on the object set users to audit, but is AD Audit Plus for the purpose of not having to sift through 1000 event logs after the fact?
0
 
LVL 119

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE^2) earned 500 total points
ID: 40366753
Yes, no need to look at Event Logs on Servers...

ADAudit Plus helps you centrally audit, monitor and report in real-time the changes on NetApp Filer CIFS Shares. ADAudit Plus reports and alerts on every possible Windows and NetApp Filer CIFS Files / Folders create, modify and delete, change permissions etc., Administrators can at-ease monitor and view pre-configured reports and schedule reports with instant alerts notification, that can be set at times of network security breach and for critical objects access. The alerts contain a thorough event analysis which helps quickly assessing the situation for a better handling. ADAudit Plus further allows organizations meet security and IT compliance needs with the data archiving feature which allows for generation of history reports. Also, reports can be exported to XLS, HTML, PDF and CSV formats for report submission during audits.

Source
http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I show you step by step with screenshots to assist you - HOW TO: Deploy and Install the VMware vCenter Server Appliance 6.5 (VCSA 6.5), with some helpful tips along the way.
The question appears often enough, how do I transfer my data from my old server to the new server while preserving file shares, share permissions, and NTFS permisions.  Here are my tips for handling such a transfer.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This video shows you how to use a vSphere client to connect to your ESX host as the root user. Demonstrates the basic connection of bypassing certification set up. Demonstrates how to access the traditional view to begin managing your virtual mac…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question