Solved

Is there a way to track files copied from file server

Posted on 2014-09-24
7
1,357 Views
Last Modified: 2014-10-11
Hello EE,

I have a very unique issue.  I have a situation where I have users who are accessing files on our file server.
1. I can see files open from manage.

My question is can I monitor if a user is copying files from the file server to their machine, USB, whatever media?
0
Comment
Question by:operationsIT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 121
ID: 40341777
You need to turn on Auditing. (both on the file server and workstation).
0
 

Author Comment

by:operationsIT
ID: 40346033
Can you set Auditing via GPO that would roll out to everyone?
0
 
LVL 121
ID: 40346052
Yes, GPO can be used to change Auditing.
0
MS Dynamics Made Instantly Simpler

Make Your Microsoft Dynamics Investment Count  & Drastically Decrease Training Time by Providing Intuitive Step-By-Step WalkThru Tutorials.

 

Author Comment

by:operationsIT
ID: 40357802
My Files are stored on a NetAPP and what I'd like to accomplish is for a group of x number of people to track:
1. What files are touched
2. If any files are copied.
0
 
LVL 121
ID: 40358009
I would look at AD Audit Plus

http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html

A fully functional 30 day trial is available to Audit CIFS shares on the NetApp Filer, files copied to and from the NetApp CIFS Shares.
0
 

Author Comment

by:operationsIT
ID: 40366729
I know you can enable access policy in GPO and then on the object set users to audit, but is AD Audit Plus for the purpose of not having to sift through 1000 event logs after the fact?
0
 
LVL 121

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE^2) earned 500 total points
ID: 40366753
Yes, no need to look at Event Logs on Servers...

ADAudit Plus helps you centrally audit, monitor and report in real-time the changes on NetApp Filer CIFS Shares. ADAudit Plus reports and alerts on every possible Windows and NetApp Filer CIFS Files / Folders create, modify and delete, change permissions etc., Administrators can at-ease monitor and view pre-configured reports and schedule reports with instant alerts notification, that can be set at times of network security breach and for critical objects access. The alerts contain a thorough event analysis which helps quickly assessing the situation for a better handling. ADAudit Plus further allows organizations meet security and IT compliance needs with the data archiving feature which allows for generation of history reports. Also, reports can be exported to XLS, HTML, PDF and CSV formats for report submission during audits.

Source
http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html
0

Featured Post

Why Off-Site Backups Are The Only Way To Go

You are probably backing up your data—but how and where? Ransomware is on the rise and there are variants that specifically target backups. Read on to discover why off-site is the way to go.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
Ransomware is a malware that is again in the list of security  concerns. Not only for companies, but also for Government security and  even at personal use. IT departments should be aware and have the right  knowledge to how to fight it.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question