[prev in list] [next in list] [prev in thread] [next in thread] 

List:       security-basics
Subject:    Re: Auditing moved/copied files on a Win2003 network
From:       Jørgen_Hovelsen <jorgen.hovelsen () ntnu ! no>
Date:       2008-02-28 16:45:00
Message-ID: 47C6E50C.7040106 () ntnu ! no
[Download RAW message or body]

Scott Race wrote:
> We have a situation where an employee is leaving and some files got
> moved on our server.  Nothing was deleted, but we're trying to figure
> out if he copied them to a CD, USB flash drive, etc.  I could not find
> where Windows 2003 Server will let you audit file copies and moves, just
> deletes and accesses.  Is there something I'm missing that's built in,
> or what 3rd party applications are available (smaller budget, office of
> 15 users)?
> 

Windows can audit "objects" (files, folders..). This type of auditing is 
default turned off.

You can read this to learn more about it: 
http://technet2.microsoft.com/windowsserver/en/library/50fdb7bc-7dae-4dcd-8591-382aeff2ea791033.mspx?mfr=true


You can also google "audit files folders windows 2003".

I have used MOM 2005 (SCOM 2007 might be a better choice now) and find 
it very useful, but it might be overkill for a small budget.

-- 
Jørgen Hovelsen


[prev in list] [next in list] [prev in thread] [next in thread]