Extensive Server Logging

By n00bst4r23 ·

I am not 100% sure how to implement this in my office domain, so I need some input.

Here's what's happening. We are a company of 50-60 people with 4 servers and one IT Administrator (me). All our computers are windows based - the users use Windows XP SP2 (I don't have the budget to upgrade them to Windows 7 yet). The servers are all Windows 2003.

Recently a lot of files and folders have been regularly "missing" from our servers. These files are client related and all the 50 users need to have access to those files to edit, change, create, delete, pretty much everything. These files are distributed on a mapped network drive shared with all users in the network. However lately many of these files and folders have been regularly missing from the shared network drives. I usually restore those files from our server backups (I run backups 5 times per day). But I really want to get to the bottom of this - why some files and folders are being deleted. In certain cases, I have had users move files or entire folders to different other undesired locations on the server. But we don't want to delete or move files that we don't need to and I need to see which user is making the mistakes.

So here's what I want:

1) I want to keep a track of every possible change a user makes on the files/folders on the shared network. Most importantly, if a file or a folder is deleted or moved, I want to know which user did this and when.

2) I did some google searching and I think there's no straightforward way to implement a rule that if a user deletes something from a shared folder, it directly goes to the Recycle Bin of the server hosting that file. There are programs like Undelete, but I was more like thinking if this is something that can be easily implemented on a server level.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -


by patb071 In reply to Extensive Server Logging

I think what you are looking for is auditing.

I have never done this but by reading the article it looks like it will help you. Also if budget doesn't allow for windows 7 you should atleast install SP3

Collapse -


by n00bst4r23 In reply to Auditing?

Thanks, this is helpful.

Yes, I should have mentioned that I rolled out Sp3 on our client machines. Not sure why I mentioned SP2 - got distracted from too much google search results.

Ideally, I would love to set up a linux file server and create shared folders from there. May be a project for me for the future.

Collapse -

audit log

by patb071 In reply to Thanks!

Also the audit log is located in the event viewer under security.

Related Discussions

Related Forums