Track and report all network and file access inc USB OR EMAIL file copy

Hi
We have s client going to court and need to track all user access and work on network including file open rename copy etc as well as browsing  activity (in same report) to see if going to gmail for example.
We can control web filter however want all user activity in one report. We want historical not just live such as filemon.

Happy go commercial paid product just need it to be clean and simple. Also access via OWA if possible and all connected devices by user

Searched EE but everything is either realtime only or web traffic

Cheers in advance
Mark PaceDIRECTORAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

KromptonCommented:
I haven't had to address these types of concerns in may years, but here goes.

Web Historian may provide some history of web sites visited. Depending on your needs you may want to use GPO to deny delete rights on Internet history files. Local security policy can be used if you are not operating an Active Directory Domain.

For file access you may not be able to get history. I can't say for certain. However, I would enable Auditing through NTFS as soon as possible for those files you need tracked. Pay attention to the section "Additional considerations" in the above link. Make sure you adjust the log file sizes and what to do when a log reaches max size since you probably don't want to lose any information.

If for some reason you are using a file system like FAT without built-in security permissions, you are probably out of luck on getting any kind of access tracking.

Additionally, if not already in place, I would implement incremental backups so you can look at files as they were and after any change may have been made. That will give you the ability to track changes but not who made them without NTFS auditing enabled.

I don't know if this information will address knowing if file access was through USB, etc... That you would need to test, but If you have all the above information you may be able to piece that information together if necessary.

Hope that helps.

Cheers,
Krompton
0
Mark PaceDIRECTORAuthor Commented:
Thanks Krompton
Problem with auditing is sifting through.
I would rather an app that can pull and report on this data based on users, time filtering etc
I need this to be long term archival as well 12+ months
If I get no other answer, I will test and implement your suggestion
0
KromptonCommented:
If you are mainly looking to monitor going forward, I have heard good things about Spector. A network monitor software package. I have not used it myself so I cannot vouch for it personally. It may not be exactly what you are looking for but reviewing it may lead you to something better suited to your needs.

If I run across more information that may be of help, I will post it for you.

Good luck,
Krompton
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
KromptonCommented:
Thank you. I hope you found what you need. There is such a wide array of programs designed for this and unless you work in an industry requried to monitor users closely, often you don't work with this type software.
Hope all goes well for you,
Krompton
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.