Solved

Is there a way to track files copied from file server

Posted on 2014-09-24
7
1,072 Views
Last Modified: 2014-10-11
Hello EE,

I have a very unique issue.  I have a situation where I have users who are accessing files on our file server.
1. I can see files open from manage.

My question is can I monitor if a user is copying files from the file server to their machine, USB, whatever media?
0
Comment
Question by:operationsIT
  • 4
  • 3
7 Comments
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
You need to turn on Auditing. (both on the file server and workstation).
0
 

Author Comment

by:operationsIT
Comment Utility
Can you set Auditing via GPO that would roll out to everyone?
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
Yes, GPO can be used to change Auditing.
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 

Author Comment

by:operationsIT
Comment Utility
My Files are stored on a NetAPP and what I'd like to accomplish is for a group of x number of people to track:
1. What files are touched
2. If any files are copied.
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
I would look at AD Audit Plus

http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html

A fully functional 30 day trial is available to Audit CIFS shares on the NetApp Filer, files copied to and from the NetApp CIFS Shares.
0
 

Author Comment

by:operationsIT
Comment Utility
I know you can enable access policy in GPO and then on the object set users to audit, but is AD Audit Plus for the purpose of not having to sift through 1000 event logs after the fact?
0
 
LVL 117

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE) earned 500 total points
Comment Utility
Yes, no need to look at Event Logs on Servers...

ADAudit Plus helps you centrally audit, monitor and report in real-time the changes on NetApp Filer CIFS Shares. ADAudit Plus reports and alerts on every possible Windows and NetApp Filer CIFS Files / Folders create, modify and delete, change permissions etc., Administrators can at-ease monitor and view pre-configured reports and schedule reports with instant alerts notification, that can be set at times of network security breach and for critical objects access. The alerts contain a thorough event analysis which helps quickly assessing the situation for a better handling. ADAudit Plus further allows organizations meet security and IT compliance needs with the data archiving feature which allows for generation of history reports. Also, reports can be exported to XLS, HTML, PDF and CSV formats for report submission during audits.

Source
http://www.manageengine.com/products/active-directory-audit/netapp-filer-auditing.html
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This article will show you how to create an ISO CD-ROM/DVD-ROM image (*.iso), and MD5 checksum signature, for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5). It's a good idea to compare checksums, because many installations fail because of a corr…
This Micro Tutorial walks you through using a remote console to access a server and install ESXi 5.1. This example is showing remote access and installation using a Dell server. The hypervisor is the very first component of your virtual infrastructu…
This video shows you how easy it is to boot from ISO images for virtual machines with the ISO images stored on a local datastore on the ESXi host.

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now