Networks

Ask something
Discussion Locked

Monitor Windows Users Access to Shared Drives

0 helpful
1 reply

by carchuleta

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have a user that seems to be up to something in one of the network shares available on my network. Apparently this person has been curious what her other co-workers have been up to and is personally taking it upon herself to investigate. I want it to stop, but I don't have proof of the activity. I'd like to be able to have a log created showing her activity on a particular shared drive (on Windows 2000 Server) with information that includes time and file (path) accessed. Is this possible without third party tools? Is it possible with third party tools? Thanks!!!!

1 reply

by bfilmfan

You can indeed monitor user's activities on a network. Depending on the depth of security required and complexity, you may or may not need a third-party product to assist you in interpreting security events.

I would recommend that you get a copy of the Windows 2000 Security Guide available here:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9964CF42-E236-4D73-AEF4-7B4FDC0A25F6&displaylang=en

The guide has in depth discussions on how to audit for security events. A discussion of Audit Object Access is available here with some of the ramifications you should consider:

http://www.microsoft.com/technet/security/topics/issues/w2kccadm/localpol/w2kadm11.mspx

In addition, make sure that you have clear approval of management, legal and HR before auditing user activity on the network.

Best of luck.

This discussion is closed to new replies.