Question Locked

Extensive Server Logging

0 helpful
4 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello,

I am not 100% sure how to implement this in my office domain, so I need some input.

Here's what's happening. We are a company of 50-60 people with 4 servers and one IT Administrator (me). All our computers are windows based - the users use Windows XP SP2 (I don't have the budget to upgrade them to Windows 7 yet). The servers are all Windows 2003.

Recently a lot of files and folders have been regularly "missing" from our servers. These files are client related and all the 50 users need to have access to those files to edit, change, create, delete, pretty much everything. These files are distributed on a mapped network drive shared with all users in the network. However lately many of these files and folders have been regularly missing from the shared network drives. I usually restore those files from our server backups (I run backups 5 times per day). But I really want to get to the bottom of this - why some files and folders are being deleted. In certain cases, I have had users move files or entire folders to different other undesired locations on the server. But we don't want to delete or move files that we don't need to and I need to see which user is making the mistakes.

So here's what I want:

1) I want to keep a track of every possible change a user makes on the files/folders on the shared network. Most importantly, if a file or a folder is deleted or moved, I want to know which user did this and when.

2) I did some google searching and I think there's no straightforward way to implement a rule that if a user deletes something from a shared folder, it directly goes to the Recycle Bin of the server hosting that file. There are programs like Undelete, but I was more like thinking if this is something that can be easily implemented on a server level.

4 replies

by patb071

I think what you are looking for is auditing.

http://support.microsoft.com/kb/310399

I have never done this but by reading the article it looks like it will help you. Also if budget doesn't allow for windows 7 you should atleast install SP3

by n00bst4r23

Thanks, this is helpful.

Yes, I should have mentioned that I rolled out Sp3 on our client machines. Not sure why I mentioned SP2 - got distracted from too much google search results.

Ideally, I would love to set up a linux file server and create shared folders from there. May be a project for me for the future.

by patb071

Also the audit log is located in the event viewer under security.

This discussion is closed to new replies.