General discussion

Locked

Last access of file-Folders

By dennisbv ·
Through a mistake a user was added to a shared folder containing sensitive info. They should have had no Access to it. I have auditing set for failed access. What I need to know is there a way I can see when those files/Folders were accessed? IfI go to the folder an try to look at the properties it shows the current date. How can I tell if this person accessed these files?

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Last access of file-Folders

by timwalsh In reply to Last access of file-Folde ...

You can't unless you also have auditing set for successful access on that specific folder.

Collapse -

Last access of file-Folders

by dennisbv In reply to Last access of file-Folde ...

Poster rated this answer

Collapse -

Last access of file-Folders

by alveden In reply to Last access of file-Folde ...

I am assuming that you are running on a windows 2000 platform, since you did not mention the OS.

The right-click properties on file/folder don't really help much. As you have notice, it only give the create timestamp for directory, and although it gives a create, modify and access timestamp for files, the access timestamp is useless, as by checking the file properties, it will show your action as the most current.

With your current setup, with only auditing turn on for failed access ( agian I am assuming that you meant Audit Object Access ), you would not be able to track a person who access those file successfully. Since you have given the right for the user to access the folder, your audit will not be able to pick it up.

There is no way you can back track and obtain the info that you need as none of it is log by the audit. You could set full audit just in case incident of this nature repeat itself .. but would need to ensure that the server will be able to handle the extra overhead.

Collapse -

Last access of file-Folders

by dennisbv In reply to Last access of file-Folde ...

Poster rated this answer

Collapse -

Last access of file-Folders

by dennisbv In reply to Last access of file-Folde ...

This question was closed by the author

Back to Security Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums