Re: Track user behavior for a shared folder

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 05/31/05 

Date: Tue, 31 May 2005 06:16:06 -0700

After you has set the needed file auditing for create and delete events, you
could use a tool like EventCombNT to filter the security log to show only
the exents of interest. 

-- 
Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"Angus" <Angus@discussions.microsoft.com> wrote in message
news:B44A1D21-B68F-4C7B-A610-C525A2CE7EAD@microsoft.com...
> I have a shared folder on a shared drive, everyone can access, save and
move
> file to/from this folder. However, I have to track who and when the user
save
> file , and who and when the user move file from this folder. How? Can I
> export this log to a text or excel file?

Relevant Pages

  • Re: Folder access log enabled
    ... audited just read data/list directory for a folder. ... folder created nine entries in my security log. ... Primary Logon ID: ... Client User Name: - ...
    (microsoft.public.win2000.security)
  • Re: Cannot see audit events in security log
    ... I tried turning auditing off and on again after converting to NTFS in ... > If you enabled auditing of object access then you should see events in the ... > the size of the security log quite a bit and clear the log first. ... >> trying to establish auditing on a folder and its contents. ...
    (microsoft.public.win2000.security)
  • Re: File auditing not working properly
    ... Try auditing only a specific folder first so that you can see how it works ... etc. Make sure your security log is large enough to keep the ... Event Type: Success Audit ...
    (microsoft.public.win2000.security)
  • RE: Auditing changes to the group policies
    ... You can filter your Security Log. ... There are another events with the same Souce, ... management tool like Microsoft Operations Manager. ...
    (microsoft.public.windows.group_policy)
  • Re: duplicate eventID 560?
    ... Object access will generate a ton of events in the ... security log. ... When you configure auditing of a folder be sure to audit the ...
    (microsoft.public.security)