General discussion

Locked

Tracking Shares on NT4 Network

By dwh ·
We have had an outbreak at work recently where Win9X workstations have had folders/drives shared out and apparently read by non-owners/unauthorized persons. The workstation owners have claimed that they did not create the shares on their workstations. Sounds very nefarious!

It would be handy to be able to compile a list of workstation shares and, more importantly, keep track of when (and who)used the shares.

Any ideas on the best way to monitor/manage this type of network activity?

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Tracking Shares on NT4 Network

by rickh9 In reply to Tracking Shares on NT4 Ne ...

If your users havn't created the shares on their workstations, the only thing that comes to mind is that someone in your domain with admin rights is accesing the drives. This would require that the default share access method be changed to "User Level" in your network configuration. Of course all of you windows machines will show the ipc$ share as the default. For administrative purposes this is a very useful feature but presents a security risk if your admin accounts are not protected. One thing you can do is run netwatch.exe on the Win9x machines and see if you can record who has gained access to the share.

Collapse -

Tracking Shares on NT4 Network

by dwh In reply to Tracking Shares on NT4 Ne ...

Poster rated this answer

Collapse -

Tracking Shares on NT4 Network

by dwh In reply to Tracking Shares on NT4 Ne ...

This question was closed by the author

Back to Windows Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums