Solved

File and Folder Auditing

Posted on 2015-02-16
2
77 Views
Last Modified: 2015-02-19
Hello Experts,

Can someone pls help me with my issue.
I'm having difficulty getting the detail I want from Windows' build in auditing.
I have enabled auditing and the server is auditing folder access, I can also trace when a folder is deleted.

What I don't get  - and need:

file created (example .pdf)(user that actioned this must be recored also)
file deleted (example .pdf)(user that actioned this must be recored also)
file renamed(user that actioned this must be recored also)
folder renamed(user that actioned this must be recored also)

Thanks
0
Comment
Question by:NSI-Tech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 9

Accepted Solution

by:
Christopher Jay Wolff earned 500 total points
ID: 40612196
Hi.  I can't try any of this but thought you might benefit from some links I came across.  To make sure the bases are covered, here is a discussion on what needs to be done for auditing and says you can do it incrementally rather than all at once across the organization.  Audit discussion is about half way down and has a link to, what was a Data Classification Toolkit beta that I cannot access but maybe you can.  It also provides good reference links at the bottom.
http://blogs.technet.com/b/windowsserver/archive/2012/05/22/introduction-to-windows-server-2012-dynamic-access-control.aspx

The second row of the Microsoft table in the link below, has links for auditing with helpful guidelines.
https://technet.microsoft.com/en-us/library/hh831542.aspx

The first link in that row discusses what needs to be done with AD, GPO, on the Server, and what goes on with the user.
https://technet.microsoft.com/en-us/library/hh831476.aspx

Within that link is the step-by-step that may be of use to you here.
https://technet.microsoft.com/en-us/library/hh831542.aspx

I read the annoying part is admins prefer not to have to parse the data looking for something.  On one of the pages someone in the community posted a URL for a third party solution.  The link is below and you can see the reviews and explore that.  It might make life easier.
http://www.lepide.com/file-server-audit/

Of course all the links above have links to more info.  My apologies it is so much to read.  Are you beyond all this with your efforts already?  Maybe someone that does this has a more direct approach.
0
 

Author Comment

by:NSI-Tech
ID: 40613536
thanks Christopher
I will have a look and get back to you.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Table of Contents: Lesson 1 - Installing Windows Server 2012 (http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_Server_2012/A_11592-Become-an-Administrator-Installing-Windows-Server-2012.html) Lesson 2 - Configuring Ser…
A procedure for exporting installed hotfix details of remote computers using powershell
In this Micro Tutorial viewers will learn how to restore their server from Bare Metal Backup image created with Windows Server Backup feature. As an example Windows 2012R2 is used.
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question