Windows Forum

Ask something
Discussion Locked

track user activity

0 helpful
5 replies

by and_the_beat_goes_on 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I need to track the activity of a specific Win9x client. This user connects to NT 4.0 servers. In particular I would like to track all files accessed and/or copied. While the NT Server event log does a good job telling me what files were printed, iteither does not, or I do not know how to interpret any files that were otherwise accessed. Does NT have this capability and if so what part am I missing or is there a 3rd party application that can be loaded on the server or even the client (where the user does not know of course)where I can track activity. Thanks for the help.

5 replies

by liquidcoolit

NT has its own built in auditor. If you go to User Manager for Domains. And you go to Policy and Audit. You can set a whole lot of functions there to Audit all user activity and File access activiy.

Cheers ....

by and_the_beat_goes_on

"Thanks a lot, while you were first with the correct info, soulrider gave a very detailed response which was easy to follow. Though I do appreciate your response, I am giving the points to him. Thanks and sorry.

by dmiles

Consider using auditing utility
Log on as Administrator
Click Start--Programs--Administrative Tools and Start User Manager
Form Policies Menu,select Audit
Enable the events you want to Audit and click OK
Auditing on files/directories
Start Explorer
Right-click on the file/directory you want to audit and from the context menu select properties
Select the security tab and click Auditing
If you have selected a directory,check the "replace auditing on subdirectories"
Click the Add buttonand add the user who you wish to audit by selecting and clicking Add
When finished adding users,Click OK
Select the events you wish to audit and then click OK
Make sure that File access auditing is enabled (Start--Programs--Administrative Tools-User Manager--Policies--Audit)
These events can then be viewed using theEvent Viewer (Start--Programs--Administrative Tools-- Event Viewer--Log--Security)

This discussion is closed to new replies.