Re: Audit trail or log when accessing a file

"Rock" <Rock@xxxxxxxxxx> wrote in message
news:%237AW4gApHHA.4772@xxxxxxxxxxxxxxxxxxxxxxx
"Gary Richtmeyer" wrote
I have a client with 8 Win XP PCs on a small peer network (a workgroup,
not a domain). One PC is a file server which holds the business-related
files that everybody in the office is allowed to access (read-only).

Yesterday, one of his employees quit and the client is wondering if that
employee viewed (and maybe copied) any of the files containing customer
lists. Even though everybody has permission to view the files, the client
wants to know if there's any way to know _which_ employees accessed
_which_ files and _when_.

I'm not aware of any Win XP audit trail or log that would track
cross-network file access like this, at least nothing that's currently
within XP that we could query for accesses in the past. Assuming there
isn't, anyone familiar with such a tool for future use?

p.s. NTFS has a "last-accessed" date field, but it doesn't have who/when
data and it doesn't have history.

There is auditing in XP Pro. It has to be turned on. See this article
How to audit user access of files, folders, and printers in Windows XP
http://support.microsoft.com/kb/310399

--
Rock [MS-MVP User/Shell]

Thanks Rock,

I've briefly tested it on my office server and it appears that it will do
what I need. I got a LOT of events, but I'm guessing I can pare down the
auditing (I only want accesses of *files* within a folder).

-- Gary


.

Relevant Pages

  • Utility for Reporting which Folders have Auditing Turned On?
    ... folders on a volume have Auditing turned on? ... I tried turning on Auditing recently on a file server with thousands of ... files and folders and the server nearly died. ...
    (microsoft.public.win2000.security)
  • Re: Utility for Reporting which Folders have Auditing Turned On?
    ... A great collection of useful admin utils, including Auditing ... > I tried turning on Auditing recently on a file server with thousands of ... > files and folders and the server nearly died. ...
    (microsoft.public.win2000.security)
  • Re: Utility for Reporting which Folders have Auditing Turned On?
    ... A great collection of useful admin utils, including Auditing ... > I tried turning on Auditing recently on a file server with thousands of ... > files and folders and the server nearly died. ...
    (microsoft.public.win2000.security)
  • Re: Manage 30 XP, 2000, 98 without Domain Controller
    ... account on 98 machines) ... folders on the File Server, setup NTFS permission on each folder. ... How to prevent them from share out local folders, ... So is it possible to make the workgroup change ...
    (microsoft.public.windowsxp.security_admin)
  • Re: how to deal with security permission on folders
    ... you may use File Server Migration Toolkit to migrate the file server. ... Microsoft Global Technical Support Center ... |> hosting hundreds of users folders, with each folder having permission ...
    (microsoft.public.windows.server.migration)