Tracking user steps on files
-
I've been asked if its possible to view a log of file changes. eg. logs of when and who opens/reads/deletes/copies files within a folder on the server.
Is this possible perhaps via event viewer or other?
We have a single File Server with Domain Controller. All users authenticate to the server so wanted to know if there is some way we can monitor or check who has accessed what etc.Thoughts appreciated.
-
Server details?
OS version?
-
Windows file and object audit policies.
-
-
@crustachio has the answer you need.
Although I don't know how you'd be able to get copy records....
-
@DustinB3403 said in Tracking user steps on files:
@crustachio has the answer you need.
Although I don't know how you'd be able to get copy records....
Not natively. Possibly with third party tools but it's not surefire.
-
@Joel said in Tracking user steps on files:
@gjacobse said in Tracking user steps on files:
Server details?
OS version?
Windows Server 2012 R2
Audit records will tell you everything that can be told. Copy, however, doesn't have an "action" with it so there is no means of tracking that. The server isn't told when a copy is made, so there is no way to log that.
-
Depending on how important it is to management, and how much money they might be willing to spend, Netwrix Auditor can track all of the information you're wanting to track, and then some.
-
You need to first enable auditing of object access --> Whichever Top Level Policy--> Computer Configuration--> Windows Settings--> Security Settings-->Local Policies-->Audit Policy-->Audit Object Access - you can enable success/failure.
-
@scottalanmiller said in Tracking user steps on files:
@Joel said in Tracking user steps on files:
@gjacobse said in Tracking user steps on files:
Server details?
OS version?
Windows Server 2012 R2
Audit records will tell you everything that can be told. Copy, however, doesn't have an "action" with it so there is no means of tracking that. The server isn't told when a copy is made, so there is no way to log that.
Will that record access if say, viewed in preview pane, rather than opened fully? Would be good to setup prtg to look in event log for that on specific files, if possible.
-
If you're looking for something free, does this fit the bill?
http://www.nirsoft.net/utils/folder_changes_view.html -
@Jimmy9008 said in Tracking user steps on files:
@scottalanmiller said in Tracking user steps on files:
@Joel said in Tracking user steps on files:
@gjacobse said in Tracking user steps on files:
Server details?
OS version?
Windows Server 2012 R2
Audit records will tell you everything that can be told. Copy, however, doesn't have an "action" with it so there is no means of tracking that. The server isn't told when a copy is made, so there is no way to log that.
Will that record access if say, viewed in preview pane, rather than opened fully? Would be good to setup prtg to look in event log for that on specific files, if possible.
It should has it has to open it for that.
