General discussion

  • Creator
    Topic
  • #2100249

    track user activity

    Locked

    by and_the_beat_goes_on ·

    I need to track the activity of a specific Win9x client. This user connects to NT 4.0 servers. In particular I would like to track all files accessed and/or copied. While the NT Server event log does a good job telling me what files were printed, iteither does not, or I do not know how to interpret any files that were otherwise accessed. Does NT have this capability and if so what part am I missing or is there a 3rd party application that can be loaded on the server or even the client (where the user does not know of course)where I can track activity. Thanks for the help.

All Comments

  • Author
    Replies
    • #3613473

      track user activity

      by liquidcoolit ·

      In reply to track user activity

      NT has its own built in auditor. If you go to User Manager for Domains. And you go to Policy and Audit. You can set a whole lot of functions there to Audit all user activity and File access activiy.

      Cheers ….

      • #3613422

        track user activity

        by and_the_beat_goes_on ·

        In reply to track user activity

        “Thanks a lot, while you were first with the correct info, soulrider gave a very detailed response which was easy to follow. Though I do appreciate your response, I am giving the points to him. Thanks and sorry.

    • #3613462

      track user activity

      by dmiles ·

      In reply to track user activity

      Consider using auditing utility
      Log on as Administrator
      Click Start–Programs–Administrative Tools and Start User Manager
      Form Policies Menu,select Audit
      Enable the events you want to Audit and click OK
      Auditing on files/directories
      Start Explorer
      Right-click on the file/directory you want to audit and from the context menu select properties
      Select the security tab and click Auditing
      If you have selected a directory,check the “replace auditing on subdirectories”
      Click the Add buttonand add the user who you wish to audit by selecting and clicking Add
      When finished adding users,Click OK
      Select the events you wish to audit and then click OK
      Make sure that File access auditing is enabled (Start–Programs–Administrative Tools-User Manager–Policies–Audit)
      These events can then be viewed using theEvent Viewer (Start–Programs–Administrative Tools– Event Viewer–Log–Security)

      • #3613423

        track user activity

        by and_the_beat_goes_on ·

        In reply to track user activity

        Thanks so much, easy to follow and implement, and already done. Can now move on to next issue of the day

    • #3613421

      track user activity

      by and_the_beat_goes_on ·

      In reply to track user activity

      This question was closed by the author

Viewing 2 reply threads