Shared Folder Forensics

[Bruce Wayne]

Does the NET USE command leave any sort of evidence? We have a user
suspected of connecting to a certain shared folder she should not have been
allowed to access (this was prior to tightening the permissions on the
folder and enabling auditing). Is there any way to check the history of NET
USE on a client computer, to see whether the user actually did access the
confidential shared folder?

Thanks for any help!

 

[Lanwench [MVP - Exchange]]

In

Does the NET USE command leave any sort of evidence? We have a user
suspected of connecting to a certain shared folder she should not
have been allowed to access (this was prior to tightening the
permissions on the folder and enabling auditing). Is there any way to
check the history of NET USE on a client computer, to see whether the
user actually did access the confidential shared folder?

Thanks for any help!

Not that I know of - and access would be logged on the server, not client -
presuming you'd enabled auditing for such things ahead of time.
If your company hadn't locked things down beforehand, the user might well be
able to make the case that this wasn't 'unauthorized' anyway. I think this
is a case of locking the barn door after the horses are gone, honestly.

 

[Steven L Umbach]

God I hate when that happens. You would not believe how many good horses I
have lost. You would think I would have wised up after the third time. At
least my feed bill is a lot lower. --- Steve


"Lanwench [MVP - Exchange]"

 

[Lanwench [MVP - Exchange]]

In

God I hate when that happens. You would not believe how many good
horses I have lost. You would think I would have wised up after the
third time. At least my feed bill is a lot lower. --- Steve

Have you installed the latest service pack for that? ;-)

"Lanwench [MVP - Exchange]"

. I think this is a case of locking the barn door after the horses
are gone, honestly.