How do I audit who adds files to a file server and how big they are.

How do I audit who adds files to a file server and how big they are.
We have an issue at a facility where we keep running out of storage space.
Thank you
RSchalhoubAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

 
Steve KnightIT ConsultancyCommented:
What server OS are you running?  You can see who writes the files by checking the owner of the file in security tab of it's properties.  To find where the space is being used up "Tree size free" is a good start to get visual breakdown - https://jam-software.com/treesize_free/ or in the Microsoft store.

You can run storage reports across the server depending upon OS - rather than re-inventing the wheel, here is good blog showing you some of the options and how to set it up

https://4sysops.com/archives/file-server-resource-manager-fsrm-part-1-install-frsm/
https://4sysops.com/archives/file-server-resource-manager-fsrm-part-5-storage-reports/

Steve
0
 
Naveen SharmaCommented:
Open Server Manager on your file server.  Under Roles, File Services, Share and Storage management you will see File Server Resource Manager. Under that you have Storage Reports Management.  Just setup the report you need and schedule it.

Storage Reports Management: https://docs.microsoft.com/en-us/windows-server/storage/fsrm/storage-reports-management

Additionally, try LepideAuditor for File Server to audit who created, modified or deleted file and folders from where and when in real time.
0

Experts Exchange Solution brought to you by ConnectWise

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
 
Sara TeasdaleCommented:
First, you need to enable file auditing in the Local Security Policy. It is the "audit object access" option and you can enable both (successes/failures)

Once auditing is enabled, choose which files/folders you want to audit by going to the properties of the folder -> Security tab -> Advanced -> Advanced Security Settings -> Auditing tab. Add the users or groups for which access to the object should be logged.

Please refer to the below articles

https://www.ultimatewindowssecurity.com/blog/default.aspx?p=5aea7883-80c4-40cb-b182-01240cc86070

https://www.netwrix.com/how_to_detect_who_tried_to_change_file_or_folder_on_your_file_servers.html?rid=gDd88kwH

https://www.splunk.com/blog/2013/07/08/audit-file-access-and-change-in-windows.html

https://blog.syskit.com/windows-file-auditing-how-to

Otherwise, you may also try this automated solution which assists to track changes made to Files and Folders on Windows File server.
1
 
Brandon LyonSenior Frontend DeveloperCommented:
Another approach to this would be to enforce storage quotas per user.
0
 
Steve KnightIT ConsultancyCommented:
Agreed, I normally do both.... set sensible quotas to stop somebody copying 100Gb of data to their redirected desktop etc. alongside storage reports + general monitoring of total storage used periodically so that any big changes are spotted too.
1
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.