Announcement

Collapse
No announcement yet.

find who accessed folder

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • find who accessed folder

    how to find who accessed folder (last and before)?

    Is there some program with GUI?
    "When you hit a wrong note it's the next note that makes it good or bad". Miles Davis

  • #2
    Re: find who accessed folder

    You will need to enable object access auditing so it cannot be done retroactively
    Two steps:
    Create a GPO which applies to the servers to be monitored and enable Object Access Auditing (Success and/or Failure)
    Then go to the folder to be monitored -- Properties -- Security -- Advanced and go to the auditing tab -- turn on the various events to be audited and the users who should be audited

    Audit results go in the security event log on the server and a LOT of events are generated
    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    PhD, MSc, FIAP, MIITT
    IT Trainer / Consultant
    Ossian Ltd
    Scotland

    ** Remember to give credit where credit is due and leave reputation points where appropriate **

    Comment


    • #3
      Re: find who accessed folder

      Hi,

      Ossian answer is recommendable apart from this you can go for this option also

      For this you have two options

      First you have to enable the auditings.

      Then please refer these links.

      http://gallery.technet.microsoft.com/scriptcenter

      http://technet.microsoft.com/en-us/m...iptingguy.aspx

      http://technet.microsoft.com/library/ee198703.aspx

      http://technet.microsoft.com/en-us/l.../bb727008.aspx

      Second you can use any third party tool of auditor so as to make your work bit easy. if you want i can recommend you one.

      Hope it works for you.

      Comment


      • #4
        Re: find who accessed folder

        I've often wanted to audit files/folder on our servers to find out which muppet keeps 'accidentally' deleting stuff.
        But, i've been told that auditing adds quite an overhead to the network, so i've never bothered with it.

        Is that correct?

        Comment


        • #5
          Re: find who accessed folder

          Not so much network overhead, but the security event log fills up at a rate of knots.

          IMHO test it, then disable until needed -- certainly don't keep it on regularly unless you have some particularly sensitive folders/files.
          Also be fully aware of the range of events generated and the differences between success and failure auditing
          Tom Jones
          MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
          PhD, MSc, FIAP, MIITT
          IT Trainer / Consultant
          Ossian Ltd
          Scotland

          ** Remember to give credit where credit is due and leave reputation points where appropriate **

          Comment

          Working...
          X