General discussion

Locked

Tracking File access on 2000 Pro

By jlstrader ·
Is there a way to track who logs onto a computer and what files they are accessing? We are have a problem with people deleting files and contacts out of Outlook. We need to track access to find out who is doing this. Help.

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Tracking File access on 2000 Pro

by glenfahan In reply to Tracking File access on 2 ...

This is an option:

You can set audit policies for different categories of system events, such as security, file and folder access, and printer access. You should start by setting a security policy for your entire system. Enable security auditing in the Group Policy Object (GPO) that's appropriate for your computer configuration. For example, on a domain controller, you should edit the default GPO. Once you've opened the appropriate GPO, select Computer Configuration | Windows Settings | Security Settings | Local Policy | Audit Policy. In the details pane, you'll find the different policy settings you can configure to track security events. The current setting for each policy option is listed in the Computer Setting column. If a policy setting has been included in a GPO, but isn't configured (the Define These Policy Settings box is checked, but neither Success nor Failure is selected--these settings are defined below), the Computer Setting column will read "No auditing." If a policysetting has been excluded from the GPO (the Define These Policy Settings check box isn't selected), the Computer Setting column will read "Not defined."

To create or edit an audit policy, you need the Manage Auditing And Security Log user right. By default, this right is granted to members of the Administrators group. If you have the proper user right to configure a policy setting in your audit policy, double-click on the desired policy setting in the details pane and select the Define ThesePolicy Settings check box. The Success or Failure check boxes then become available.

You check the Success and/or Failure check boxes to establish auditing for that policy setting. When you enable the auditing feature, there's a small amount of performance overhead generated. Therefore, you should only include the minimum number of events in the audit policy.

Collapse -

Tracking File access on 2000 Pro

by jlstrader In reply to Tracking File access on 2 ...

Poster rated this answer

Collapse -

Tracking File access on 2000 Pro

by glenfahan In reply to Tracking File access on 2 ...

This is the part you will be most interested in:

Auditing files, folders, and printers located on NTFS volumes is just a bit different from setting up your system audit policy as I described. You first configure the Object Access policy setting in your audit policy. Then you use the file, folder, or printer's Properties dialog box to configure the specific levels of access for each user or group you want to track. Note that you can only audit files and folders that are stored on NTFS volumes. To configure auditing for a file, folder, or printer object, begin by opening the object's Properties dialog box, and selecting the Security tab. Now, click the Advanced button. Then, select the Auditing tab and click Add to add an audit entry for a specific user or group.
Finally, configure the events that you want to audit with this audit entry. You can audit different events depending upon the type of object you have selected. For example, for a folder object, you can audit users' attemptsto create files in the folder. For a printer object, you can audit users' attempts to manage documents in the print queue.

Collapse -

Tracking File access on 2000 Pro

by jlstrader In reply to Tracking File access on 2 ...

Poster rated this answer

Collapse -

Tracking File access on 2000 Pro

by jlstrader In reply to Tracking File access on 2 ...

This question was closed by the author

Back to Windows Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums