Windows Forum

Ask something
Discussion Locked

Auditing Users drive mappings

0 helpful
4 replies

by dieatomkinder

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am setting up auditing policies and I am wondering can you audit when people map a network drive? and can you log where the drive was mapped to. I looked in the security policy under the local security settings. I enabled Audit the access of global system objects but when I map a drive it doesn't seem to get audited nor does it tell the location of the drive I mapped to ie \\somecomputer\someshare

4 replies

by dieatomkinder

also this is not auditing connections to a local machine, I want to audit connections from a local machine to a remote machine.

by joseph moore

A tool I use that can tell you stuff like this is Dameware NT Utilities.
One of the things it can do is connect to a file server, then you can select all Shares on the machine, and pull up who is connected to each share.
It gives you the connectuser, from what computer they are connecting from, the date and time they connected, the idle time of ttheir connection, how many open files they have, and if they are a member of the Guest group.
You can also see what individual files they have open. Last, you can disconnect them if you want.

www.dameware.com

by dieatomkinder

I have no access to the remote machine, I have a local server that the users do need to be able to map to. But I have users that are suspected of mapping to other remote machines. I need to find out what the remote machines are that they are connecting to, when, and then I can find out the why. This is a "secure" networking environment and having user map out to other server is undermining that security. So how do I audit the local workstation to show where it's connecting to when I am notaround?

by joseph moore

Since I love Dameware, I will clarify my previous answer.
With Dameware, you do not need physical access to the machine(s) you want to scan. It will scan across your network.
So, if you have some servers you want to see if anyone is connected to them, you can select each server, and then choose the Sessions icon. It will then pull up every single user who is connected to the machine. YOu get user name, machine name and some statistics.
You could then choose the Open Files icon and see what files/folders each user has open, and in what capacity. It is a whole lot easier to read this in Dameware than it does if you use the NT Server Manager. It is basically the same functionality, but in Server Manager, it is hard to figure anything out.Dameware let's you sort columns to make it easier to read.

This discussion is closed to new replies.