Solved

audit access to share drive or folder

Posted on 2014-10-03
5
243 Views
Last Modified: 2014-10-04
I have been tasked with finding out when a shared driver/folder has been accessed and by whom.  Auditing is NOT turned on.  Is there another way to gather the required information?
0
Comment
Question by:sptech
5 Comments
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40359661
if auditing is not on, you will not get anything historical
if you turn it on now, you will get info on a go-forward basis
0
 
LVL 9

Expert Comment

by:nattygreg
ID: 40360772
no, only moving forward with audit on
0
 
LVL 23

Accepted Solution

by:
DanCh99 earned 500 total points
ID: 40361072
As above, you can't audit retrospectively.

your last gasp might be to check the MRU (Most Recently Used) file lists on your suspect's PCs.  There are many places where these are stored.
Here's an article on how to clear the lists (and therefore where they are).
http://www.dummies.com/how-to/content/how-to-get-rid-of-recently-opened-file-lists.html

For instance, here's the reg entry for Word
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU.

However, be aware, that as the article suggests, these lists can be cleared (in a number of different ways), so a "clean" list is not proof of innocence.  However, a "dirty" list could be proof of guilt!
0
 

Author Closing Comment

by:sptech
ID: 40361199
Never would have thought to check the MRU lists.  Thanks
0
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40361761
that would be extremely tedious to go through every user account on every system to do that and check every single entry as to the location if it is where you are looking for
if they cleared the MRU list you would get nowhere
not really any sort of solution
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This Micro Tutorial will teach you how to the overview of Microsoft Security Essentials. This is a free anti-virus software that guards your PC against viruses, spyware, worms, and other malicious software. This will be demonstrated using Windows…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now