Tracking access to folder

[Doug]

Hello All:

I need to track access to a specific folder and also a particular users
movements around the network. Without running a sniffer fulltime, is there
anyway to accomplish this.

If I turn on auditing, I'm getting all events and I just need it for one
user and in particular, his/her access to specific folders.

thanks

 

[Steven L Umbach]

Enabling auditing of object access will generate a lot of seemingly
unrelated events but that just goes with the territory. When configuring
auditing for a folder be sure just to specify the users or a group
containing the users you want to track instead of users or everyone. Then
audit only the permissions you want to track instead of every permission and
the type of permission whether it be success or failure. List and read
permissions will generate a lot of object access events for success. What
can really help is to use the free Event Comb from Microsoft to search the
security logs as you can specify particular events and also text strings
such as user name or folder/file name. That can help you quickly find
relevant information. --- Steve

 

[Doug]

Thanks for the information, very helpful

Enabling auditing of object access will generate a lot of seemingly
unrelated events but that just goes with the territory. When configuring
auditing for a folder be sure just to specify the users or a group
containing the users you want to track instead of users or everyone. Then
audit only the permissions you want to track instead of every permission
and the type of permission whether it be success or failure. List and read
permissions will generate a lot of object access events for success. What
can really help is to use the free Event Comb from Microsoft to search the
security logs as you can specify particular events and also text strings
such as user name or folder/file name. That can help you quickly find
relevant information. --- Steve