Is there a way to track files copied from file server

Hello EE,

I have a very unique issue.  I have a situation where I have users who are accessing files on our file server.
1. I can see files open from manage.

My question is can I monitor if a user is copying files from the file server to their machine, USB, whatever media?
operationsITAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
You need to turn on Auditing. (both on the file server and workstation).
0
operationsITAuthor Commented:
Can you set Auditing via GPO that would roll out to everyone?
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Yes, GPO can be used to change Auditing.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

operationsITAuthor Commented:
My Files are stored on a NetAPP and what I'd like to accomplish is for a group of x number of people to track:
1. What files are touched
2. If any files are copied.
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
I would look at AD Audit Plus

http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html

A fully functional 30 day trial is available to Audit CIFS shares on the NetApp Filer, files copied to and from the NetApp CIFS Shares.
0
operationsITAuthor Commented:
I know you can enable access policy in GPO and then on the object set users to audit, but is AD Audit Plus for the purpose of not having to sift through 1000 event logs after the fact?
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Yes, no need to look at Event Logs on Servers...

ADAudit Plus helps you centrally audit, monitor and report in real-time the changes on NetApp Filer CIFS Shares. ADAudit Plus reports and alerts on every possible Windows and NetApp Filer CIFS Files / Folders create, modify and delete, change permissions etc., Administrators can at-ease monitor and view pre-configured reports and schedule reports with instant alerts notification, that can be set at times of network security breach and for critical objects access. The alerts contain a thorough event analysis which helps quickly assessing the situation for a better handling. ADAudit Plus further allows organizations meet security and IT compliance needs with the data archiving feature which allows for generation of history reports. Also, reports can be exported to XLS, HTML, PDF and CSV formats for report submission during audits.

Source
http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.