Logging actions.

  • Thread starter Thread starter Carl Hilton
  • Start date Start date
C

Carl Hilton

I have a few network share folders that are being moved/ deleted/
re-created, and NOONE is saying they are doing it.. .Of course USERS do a
lot of things they don't realize they are doing... Is there a tool that I
can run that will log specific actions within a specific folder, such as
copy/move/delete/create.. I think I have auditing turned on but can not make
sense of the event log files.

Thanks

Carl
 
You could just use NTFS auditing.
http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
which for some odd reason does not mention enabling auditing, so
http://support.microsoft.com/default.aspx?scid=kb;en-us;300549

In your case, it sound like auditing of Delete for This folder and
subfolders (ie not files) would be sufficient, set at the root of the
area and allowed to inherit down, or set on the specific folders
of concern to you. What you do want to do is make sure that you
audit for something that will catch what is of interest but that does
not catch much else as you will get too much info in which to look
for what is of interest.
 
The tool you are looking for is called NTFS. Set your permissions so people
can't do things they are not supposed to be doing. If they are at the
knowledge level where they are doing things by accident (like moving folders
or shares), then they should not have the ability to do those things.
 
Back
Top