Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1525
  • Last Modified:

Is there a way to track files copied from file server

Hello EE,

I have a very unique issue.  I have a situation where I have users who are accessing files on our file server.
1. I can see files open from manage.

My question is can I monitor if a user is copying files from the file server to their machine, USB, whatever media?
0
operationsIT
Asked:
operationsIT
  • 4
  • 3
1 Solution
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
You need to turn on Auditing. (both on the file server and workstation).
0
 
operationsITAuthor Commented:
Can you set Auditing via GPO that would roll out to everyone?
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Yes, GPO can be used to change Auditing.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
operationsITAuthor Commented:
My Files are stored on a NetAPP and what I'd like to accomplish is for a group of x number of people to track:
1. What files are touched
2. If any files are copied.
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
I would look at AD Audit Plus

http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html

A fully functional 30 day trial is available to Audit CIFS shares on the NetApp Filer, files copied to and from the NetApp CIFS Shares.
0
 
operationsITAuthor Commented:
I know you can enable access policy in GPO and then on the object set users to audit, but is AD Audit Plus for the purpose of not having to sift through 1000 event logs after the fact?
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Yes, no need to look at Event Logs on Servers...

ADAudit Plus helps you centrally audit, monitor and report in real-time the changes on NetApp Filer CIFS Shares. ADAudit Plus reports and alerts on every possible Windows and NetApp Filer CIFS Files / Folders create, modify and delete, change permissions etc., Administrators can at-ease monitor and view pre-configured reports and schedule reports with instant alerts notification, that can be set at times of network security breach and for critical objects access. The alerts contain a thorough event analysis which helps quickly assessing the situation for a better handling. ADAudit Plus further allows organizations meet security and IT compliance needs with the data archiving feature which allows for generation of history reports. Also, reports can be exported to XLS, HTML, PDF and CSV formats for report submission during audits.

Source
http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now