is there a way to determine which files a user has been copying from the file server ? SBS2008

Andre P
Andre P used Ask the Experts™
We have a concern that a user may be stealing documents from the server .
Is there a way to determine historically what files a user may have been copying ?
And going forward what is best practice for determining this and preventing this ?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2016
In the past no.. You can enable auditing of file operations but this is a global (meaning all users item) which means that these security logs will grow very quickly and all users may notice a decrease in server performance. File copying implies a source and a destination. if you can monitor the destination it is a lot easier to separate the wheat from the chaff. Then you have to determine which is normal file access (required to perform their job function) or suspicious activity.

Since we all know that locks only keep honest people honest, it is time for you to look at your file access policies and start restricting items.. If someone doesn't need access to a file to perform their job then they should not even know it exists.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial