Monitoring a user


I need to monitor a specific user on our Windows network.  That user is having some type issues where she saves a file, it leaves behind the temp file and then deletes the file she was attempting to save.  Does anyone have a recommendation for such a scenario?  I am looking for something simple and easy to use and preferably free.

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Mark BillExchange, AD, SQL, VMware, HPE, 3PAR, FUD, Anti MS Tekhnet, Pro EE, #1Commented:
Sounds like your antivirus is causing the issue usually this is an on access scanning part of the anti virus that can be turned off.

Example though watch out for these kinds of things, in AVG on access scanning is called Resident Shield.
It may be called something else in your antivirus software.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Darshana JayathilakeSystem EngineerCommented:
first try to exclude the application(excel/word) from your antivirus software and check the functionality. also this can be because of some third party add-ons.
cheesebugahAuthor Commented:
We use Eset Enterprise here.  She is the only one on the network having this issue.  I upgraded her from Office 2007 to 2010 over the weekend and it seems to have not happened again, but I am not real confident the upgrade is the real fix.
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Mark BillExchange, AD, SQL, VMware, HPE, 3PAR, FUD, Anti MS Tekhnet, Pro EE, #1Commented:
As i said originally the AV is the cause here trust me, excluding directorys is a security risk lets find a different way of doing this.

How can you exclude shared directorys for a start?

The saving process may well be different in Office 2007 than 2010. I remember having these issues myself around office 2007 time.
Bryant SchaperCommented:
ok, I would agree sounds like AV, a virus or malware.  But sense everyone has the same conifg/av I doubt it is AV.

I honestly say, not put too many cycles into it and rebuild the workstation.  If it is a virus or malware, you run the risk of further infections so if it is no too much work to reinstall the OS and software, I would do that.
cheesebugahAuthor Commented:
All of these suggestions are great!  Can anyone recommend an easy to use and free monitoring tool so I can monitor her network connectivity please?
Mark BillExchange, AD, SQL, VMware, HPE, 3PAR, FUD, Anti MS Tekhnet, Pro EE, #1Commented:
The process for saving some documents is like this for example with word. it saves lots of temp files and copies of itself through the various saving processes like save, save as, autorecover.
It drives the on access scanning mad on some machines it would seem. Sometimes just deletes the file basically without logging it as a virus even.

Regarding your network tool I dont know of any really.... Not sure why we would want to do this tbh..
We dont know she has done anything right? just boot her machine into safe mode with networking one day and scan it if you need too.

Ensure her pc has no local administrator right granted to her account either, that is the biggest security risk imo, that in conjunction with spam mail.
cheesebugahAuthor Commented:
I want to check to see if her network connection is dropping at all during the day.
Mark BillExchange, AD, SQL, VMware, HPE, 3PAR, FUD, Anti MS Tekhnet, Pro EE, #1Commented:
ok, run this from a command prompt ping -a ipaddressofyourdomaincontroller >c:\pinglog.txt
This will leave a command prompt running pinging the dc. if it drops you will know there are issues there.

try checking the event log too, it will have something in it.
cheesebugahAuthor Commented:
Turned of on access scanning and the problem went away.  Thank you.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.