File UserID access monitoring on a Network?

  • Thread starter Thread starter axs221
  • Start date Start date
A

axs221

I am interested in a freeware program or alternative way to log access
to certain files on a network. I can limit access to the files on the
network, but those that still have access I'd like to know who accesses
what files and when. I've looked all over download.com and
snapfiles.com and haven't found anything capable.

Anyone know of such a program?

Shawn
 
axs221 said:
I am interested in a freeware program or alternative way to log access
to certain files on a network. I can limit access to the files on the
network, but those that still have access I'd like to know who accesses
what files and when. I've looked all over download.com and
snapfiles.com and haven't found anything capable.
Click to expand...

What OS are you using? If you're using Windows NT/2000/XP Pro and NTFS
you can turn on auditing for individual directories/files and any access
to them should be logged in full in the Security Event Log. Shout up if
you need any pointers...

HTH

B
 
Ben said:
What OS are you using? If you're using Windows NT/2000/XP Pro and NTFS
you can turn on auditing for individual directories/files and any access
to them should be logged in full in the Security Event Log. Shout up if
you need any pointers...

HTH

B
Click to expand...

We're using 2000 and XP at work, NTFS most likely. I'm not aware of how
to turn on auditing for individual files... I'll Google it, any help
would be appreciated.

Thanks,
Shawn
 
axs221 said:
We're using 2000 and XP at work, NTFS most likely. I'm not aware of how
to turn on auditing for individual files... I'll Google it, any help
would be appreciated.
Click to expand...

Hi Shawn,

If you haven't found this page already, here's the MS document to get
you started -

http://support.microsoft.com/?kbid=310399
"How To Audit User Access of Files, Folders, and Printers in Windows XP"

http://support.microsoft.com/kb/300549/en-us "How to enable and apply
security auditing in Windows 2000" explains things in a little more
detail and also explains where to find the logs after it is set up.

This link has some handy pictures of an example setup if you find the MS
link a bit too sparse - the whole thing is worth reading, but you could
just search for "Audit" and skip to the most relevant section.

http://windows.stanford.edu/docs/IntroSecurity.htm

No anchors on the page - sorry!

A nice bit of freeware for viewing Windows event logs (where the file
access will be logged) is Event Log Explorer - certainly makes filtering
and viewing the logs a lot easier for me here.

http://www.eventlogxp.com/

Hope this sets you on the right track,

Ben
 
Back
Top