You can start by enabling Object Access. On the Win2k server, go to
Administrattive tools and then click on Local Security Poliy. Navigate to
Local Policies --> Audit Policy. You should then see the different auditing
options. Double click on Audit object Access. You can then set it to either
Success (make an entry when the object is successfully accessed),
Failure(make an entry when access to an object is attempted, but fails), or
both.
Now that auditing is enabled on the system, you can setup what folder/files
you want audited. Browse to a desired folder, right click and select
properties. Click on the security tab, click the advanced button, and then
click the auditing tab. Click the Add button and you can setup what users /
groups that you want to record activity for. You can also then get pretty
granular with what types of actions you want to track... viewing files,
deleting files, etc.
Once this is done, you will be able to see the resulting audit entries in
the server's Security Event Log... Program Files --> Administrative Tools-->
Event Viewer--> Security.
As for reporting on that... well I am sure there are commercial products
specifically for that, but i don't know any off the top of my head. We use a
product called ELM Enterprise Manager to collect all of our events and report
on them - but that is probably a bit much. You can however export the list of
events right from the Event Viewer to a CSV file, import that into Excel and
create your own reports...
Hope this helps...
David
