File access on 2008 Server
Is there auditing to view folder and file access on a 2008 windows file server. Or is this like 2003 and you have to turn on auditing? Or is there any other way to view this. Basically we had an admin that was recently let go and they were suspected of accessing CEOs shared folder on the network. Any ideas?
ASKER
Yes I know that however was wondering g if there is anyway to trace without that being on
Not as far as i know. Not as far as accessing folders etc.
Someone may correct me?
Someone may correct me?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Yes that is how i see it too Lee W
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
Enable Audit Policy
1. Create a Group Policy Object and name it something to the effect of File Server Audit Policy
2. Edit the GPO, browse to Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\
Taken from: http://blogs.technet.com/b/mspfe/archive/2013/08/27/auditing-file-access-on-file-servers.aspx
Once this is on there are some useful tools:
https://technet.microsoft.com/en-us/library/dd560628%28v=ws.10%29.aspx