Auditing File Copy

[Colin J Paterson]

I would like to Audit file copy in the System area of the Event Viewer in
WindowsXP. I have turned on auditing and set up the folders I want to audit.
However there is no separate copy audit type and I see thousands of Reads
being audited. Is there any way to audit just file copies? If not natively
in XP then does anyone know of a 3rd party tool to achieve this.

Any help would be great.

Cheers

Colin

 

[Carey Frisch [MVP]]

HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399&Product=winxp

R-Guard Data Security Software
http://www.data-security-softw­are.com/

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Get Windows XP Service Pack 2 with Advanced Security Technologies:
http://www.microsoft.com/athome/security/protect/windowsxp/choose.mspx

-------------------------------------------------------------------------------------------

:

| I would like to Audit file copy in the System area of the Event Viewer in
| WindowsXP. I have turned on auditing and set up the folders I want to audit.
| However there is no separate copy audit type and I see thousands of Reads
| being audited. Is there any way to audit just file copies? If not natively
| in XP then does anyone know of a 3rd party tool to achieve this.
|
| Any help would be great.
|
| Cheers
|
| Colin

 

[Dave]

how would you know if the file is being copied or just being read for any
other reason? for instance, the low level file access is exactly the same
when you open a file and display it in notepad as when you copy it byte by
byte so some other file. so how could any audit software know for sure what
the disposition of bytes being read from a file was?

 

[Colin J Paterson]

Neither of these do what I asked.