Solved

File and Folder Auditing

Posted on 2015-02-16
2
65 Views
Last Modified: 2015-02-19
Hello Experts,

Can someone pls help me with my issue.
I'm having difficulty getting the detail I want from Windows' build in auditing.
I have enabled auditing and the server is auditing folder access, I can also trace when a folder is deleted.

What I don't get  - and need:

file created (example .pdf)(user that actioned this must be recored also)
file deleted (example .pdf)(user that actioned this must be recored also)
file renamed(user that actioned this must be recored also)
folder renamed(user that actioned this must be recored also)

Thanks
0
Comment
Question by:NSI-Tech
2 Comments
 
LVL 9

Accepted Solution

by:
Christopher Jay Wolff earned 500 total points
ID: 40612196
Hi.  I can't try any of this but thought you might benefit from some links I came across.  To make sure the bases are covered, here is a discussion on what needs to be done for auditing and says you can do it incrementally rather than all at once across the organization.  Audit discussion is about half way down and has a link to, what was a Data Classification Toolkit beta that I cannot access but maybe you can.  It also provides good reference links at the bottom.
http://blogs.technet.com/b/windowsserver/archive/2012/05/22/introduction-to-windows-server-2012-dynamic-access-control.aspx

The second row of the Microsoft table in the link below, has links for auditing with helpful guidelines.
https://technet.microsoft.com/en-us/library/hh831542.aspx

The first link in that row discusses what needs to be done with AD, GPO, on the Server, and what goes on with the user.
https://technet.microsoft.com/en-us/library/hh831476.aspx

Within that link is the step-by-step that may be of use to you here.
https://technet.microsoft.com/en-us/library/hh831542.aspx

I read the annoying part is admins prefer not to have to parse the data looking for something.  On one of the pages someone in the community posted a URL for a third party solution.  The link is below and you can see the reviews and explore that.  It might make life easier.
http://www.lepide.com/file-server-audit/

Of course all the links above have links to more info.  My apologies it is so much to read.  Are you beyond all this with your efforts already?  Maybe someone that does this has a more direct approach.
0
 

Author Comment

by:NSI-Tech
ID: 40613536
thanks Christopher
I will have a look and get back to you.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
SOFS cluser offline 3 43
Windows USB 4TB Backup Drive 7 37
Doubt. 2 58
Network data not going over intended NIC 2 22
You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
OfficeMate Freezes on login or does not load after login credentials are input.
In this Micro Tutorial viewers will learn how they can get their files copied out from their unbootable system without need to use recovery services. As an example non-bootable Windows 2012R2 installation is used which has boot problems.
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

896 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now