Expiring Today—Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

File and Folder Auditing

Posted on 2015-02-16
2
Medium Priority
?
78 Views
Last Modified: 2015-02-19
Hello Experts,

Can someone pls help me with my issue.
I'm having difficulty getting the detail I want from Windows' build in auditing.
I have enabled auditing and the server is auditing folder access, I can also trace when a folder is deleted.

What I don't get  - and need:

file created (example .pdf)(user that actioned this must be recored also)
file deleted (example .pdf)(user that actioned this must be recored also)
file renamed(user that actioned this must be recored also)
folder renamed(user that actioned this must be recored also)

Thanks
0
Comment
Question by:NSI-Tech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 9

Accepted Solution

by:
Christopher Jay Wolff earned 1500 total points
ID: 40612196
Hi.  I can't try any of this but thought you might benefit from some links I came across.  To make sure the bases are covered, here is a discussion on what needs to be done for auditing and says you can do it incrementally rather than all at once across the organization.  Audit discussion is about half way down and has a link to, what was a Data Classification Toolkit beta that I cannot access but maybe you can.  It also provides good reference links at the bottom.
http://blogs.technet.com/b/windowsserver/archive/2012/05/22/introduction-to-windows-server-2012-dynamic-access-control.aspx

The second row of the Microsoft table in the link below, has links for auditing with helpful guidelines.
https://technet.microsoft.com/en-us/library/hh831542.aspx

The first link in that row discusses what needs to be done with AD, GPO, on the Server, and what goes on with the user.
https://technet.microsoft.com/en-us/library/hh831476.aspx

Within that link is the step-by-step that may be of use to you here.
https://technet.microsoft.com/en-us/library/hh831542.aspx

I read the annoying part is admins prefer not to have to parse the data looking for something.  On one of the pages someone in the community posted a URL for a third party solution.  The link is below and you can see the reviews and explore that.  It might make life easier.
http://www.lepide.com/file-server-audit/

Of course all the links above have links to more info.  My apologies it is so much to read.  Are you beyond all this with your efforts already?  Maybe someone that does this has a more direct approach.
0
 

Author Comment

by:NSI-Tech
ID: 40613536
thanks Christopher
I will have a look and get back to you.
0

Featured Post

Learn Veeam advantages over legacy backup

Every day, more and more legacy backup customers switch to Veeam. Technologies designed for the client-server era cannot restore any IT service running in the hybrid cloud within seconds. Learn top Veeam advantages over legacy backup and get Veeam for the price of your renewal

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

My GPO's made for 2008 R2 servers were not allowing me to RDP into a new 2012 server by default.  That’s why I tried to allow RDP via Powershell, because I could log into a remote shell without further configuration. Below I will describe how I wen…
You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
In this Micro Tutorial viewers will learn how they can get their files copied out from their unbootable system without need to use recovery services. As an example non-bootable Windows 2012R2 installation is used which has boot problems.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question