How do I audit who adds files to a file server and how big they are.

How do I audit who adds files to a file server and how big they are.
We have an issue at a facility where we keep running out of storage space.
Thank you
RSchalhoubAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Steve KnightIT ConsultancyCommented:
What server OS are you running?  You can see who writes the files by checking the owner of the file in security tab of it's properties.  To find where the space is being used up "Tree size free" is a good start to get visual breakdown - https://jam-software.com/treesize_free/ or in the Microsoft store.

You can run storage reports across the server depending upon OS - rather than re-inventing the wheel, here is good blog showing you some of the options and how to set it up

https://4sysops.com/archives/file-server-resource-manager-fsrm-part-1-install-frsm/
https://4sysops.com/archives/file-server-resource-manager-fsrm-part-5-storage-reports/

Steve
0
Naveen SharmaCommented:
Open Server Manager on your file server.  Under Roles, File Services, Share and Storage management you will see File Server Resource Manager. Under that you have Storage Reports Management.  Just setup the report you need and schedule it.

Storage Reports Management: https://docs.microsoft.com/en-us/windows-server/storage/fsrm/storage-reports-management

Additionally, try LepideAuditor for File Server to audit who created, modified or deleted file and folders from where and when in real time.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Sara TeasdaleCommented:
First, you need to enable file auditing in the Local Security Policy. It is the "audit object access" option and you can enable both (successes/failures)

Once auditing is enabled, choose which files/folders you want to audit by going to the properties of the folder -> Security tab -> Advanced -> Advanced Security Settings -> Auditing tab. Add the users or groups for which access to the object should be logged.

Please refer to the below articles

https://www.ultimatewindowssecurity.com/blog/default.aspx?p=5aea7883-80c4-40cb-b182-01240cc86070

https://www.netwrix.com/how_to_detect_who_tried_to_change_file_or_folder_on_your_file_servers.html?rid=gDd88kwH

https://www.splunk.com/blog/2013/07/08/audit-file-access-and-change-in-windows.html

https://blog.syskit.com/windows-file-auditing-how-to

Otherwise, you may also try this automated solution which assists to track changes made to Files and Folders on Windows File server.
1
Brandon LyonSenior Frontend DeveloperCommented:
Another approach to this would be to enforce storage quotas per user.
0
Steve KnightIT ConsultancyCommented:
Agreed, I normally do both.... set sensible quotas to stop somebody copying 100Gb of data to their redirected desktop etc. alongside storage reports + general monitoring of total storage used periodically so that any big changes are spotted too.
1
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.