Copied files

  • Thread starter Thread starter Guest
  • Start date Start date
Is there a way to find out what files were copyied from my server to any
station?
Click to expand...


If you have some unique names, like "Company ABC secret document1.doc", you can query each station for the presence of this name.

Create a file on you workstation with all the names you are interested in checking, one per line with no quote marks. Let's assume you
name it c:\folder\search.txt

Use netdom from the Support Tools on your O/S CD-ROM.

The output will be recorded in c:\folder\report.txt.

@echo off
setlocal
if exist c:\folder\Report.txt del /q c:\folder\Report.txt
for /f "Skip=1 Tokens=1" %%i in ('netdom query /d:%USERDNSDOMAIN% WORKSTATION^|findstr /I /V /C:"The command completed successfully."') do (
call :computer %%i>nul 2>&1
)
endlocal
goto :EOF
:computer
for /f "Tokens=*" %%s in ('type c:\folder\search.txt') do (
for /f "Tokens=*" %%f in ('dir "\\%1\c$\%%s" /a /b /s^|FIND /V /I "File Not Found"') do (
@echo "%%f">>c:\folder\Report.txt
)
)

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
 
Ok,
But suppose that the computer that copied these files is no longer one the
network; like it was stolen or if is laptop?
 
Back
Top