Audit trail or log when accessing a file

[Gary Richtmeyer]

I have a client with 8 Win XP PCs on a small peer network (a workgroup, not
a domain). One PC is a file server which holds the business-related files
that everybody in the office is allowed to access (read-only).

Yesterday, one of his employees quit and the client is wondering if that
employee viewed (and maybe copied) any of the files containing customer
lists. Even though everybody has permission to view the files, the client
wants to know if there's any way to know _which_ employees accessed _which_
files and _when_.

I'm not aware of any Win XP audit trail or log that would track
cross-network file access like this, at least nothing that's currently
within XP that we could query for accesses in the past. Assuming there
isn't, anyone familiar with such a tool for future use?

p.s. NTFS has a "last-accessed" date field, but it doesn't have who/when
data and it doesn't have history.


-- Gary Richtmeyer, Tampa, FL

 

[Rock]

I have a client with 8 Win XP PCs on a small peer network (a workgroup, not
a domain). One PC is a file server which holds the business-related files
that everybody in the office is allowed to access (read-only).

Yesterday, one of his employees quit and the client is wondering if that
employee viewed (and maybe copied) any of the files containing customer
lists. Even though everybody has permission to view the files, the client
wants to know if there's any way to know _which_ employees accessed
_which_ files and _when_.

I'm not aware of any Win XP audit trail or log that would track
cross-network file access like this, at least nothing that's currently
within XP that we could query for accesses in the past. Assuming there
isn't, anyone familiar with such a tool for future use?

p.s. NTFS has a "last-accessed" date field, but it doesn't have who/when
data and it doesn't have history.

There is auditing in XP Pro. It has to be turned on. See this article
How to audit user access of files, folders, and printers in Windows XP
http://support.microsoft.com/kb/310399

 

[Gary Richtmeyer]

There is auditing in XP Pro. It has to be turned on. See this article
How to audit user access of files, folders, and printers in Windows XP
http://support.microsoft.com/kb/310399

Thanks Rock,

I've briefly tested it on my office server and it appears that it will do
what I need. I got a LOT of events, but I'm guessing I can pare down the
auditing (I only want accesses of *files* within a folder).

-- Gary

 

[Rock]

Thanks Rock,

I've briefly tested it on my office server and it appears that it will do
what I need. I got a LOT of events, but I'm guessing I can pare down the
auditing (I only want accesses of *files* within a folder).

You're welcome, Gary, glad it works for you.