General discussion

Locked

track user activity

By And_the_beat_goes_on ·
I need to track the activity of a specific Win9x client. This user connects to NT 4.0 servers. In particular I would like to track all files accessed and/or copied. While the NT Server event log does a good job telling me what files were printed, iteither does not, or I do not know how to interpret any files that were otherwise accessed. Does NT have this capability and if so what part am I missing or is there a 3rd party application that can be loaded on the server or even the client (where the user does not know of course)where I can track activity. Thanks for the help.

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

track user activity

by LiQuiDKeWL In reply to track user activity

NT has its own built in auditor. If you go to User Manager for Domains. And you go to Policy and Audit. You can set a whole lot of functions there to Audit all user activity and File access activiy.

Cheers ....

Collapse -

track user activity

by And_the_beat_goes_on In reply to track user activity

"Thanks a lot, while you were first with the correct info, soulrider gave a very detailed response which was easy to follow. Though I do appreciate your response, I am giving the points to him. Thanks and sorry.

Collapse -

track user activity

by dmiles In reply to track user activity

Consider using auditing utility
Log on as Administrator
Click Start--Programs--Administrative Tools and Start User Manager
Form Policies Menu,select Audit
Enable the events you want to Audit and click OK
Auditing on files/directories
Start Explorer
Right-click on the file/directory you want to audit and from the context menu select properties
Select the security tab and click Auditing
If you have selected a directory,check the "replace auditing on subdirectories"
Click the Add buttonand add the user who you wish to audit by selecting and clicking Add
When finished adding users,Click OK
Select the events you wish to audit and then click OK
Make sure that File access auditing is enabled (Start--Programs--Administrative Tools-User Manager--Policies--Audit)
These events can then be viewed using theEvent Viewer (Start--Programs--Administrative Tools-- Event Viewer--Log--Security)

Collapse -

track user activity

by And_the_beat_goes_on In reply to track user activity

Thanks so much, easy to follow and implement, and already done. Can now move on to next issue of the day

Collapse -

track user activity

by And_the_beat_goes_on In reply to track user activity

This question was closed by the author

Back to Windows Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums