Re: Possible to track user's file system usage?



You can enable auditing of object access on his computer and then audit
write permission on directories on his computer that he has write access to
which would be at least his user profile though this is far from a user
friendly process. If you decide to do such be sure to increase the size of
the security log on his computer to at least 20MB and understand he could
bypass auditing by writing directly to removable media such as an USB drive.
My experience in management and with people is that if they are honest and
trustworthy they will be that way till the end particularly in an
environment where employees are appreciated and treated fairly along with
being held accountable. If they are not then they already got what they
want. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;300549
http://www.microsoft.com/technet/security/topics/auditingandmonitoring/securitymonitoring/default.mspx

"-=gu=-" <gu@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:834E73B4-B734-4CEC-B08E-4AF924CBCD3C@xxxxxxxxxxxxxxxx
Hello,
We have a top level employoee who has given his 2 week notice. The
president
of the company came to me becuase he is worried that this employee will
'steal' information over the next two weeks. Now likely if he were going
to
do that, he already would have before putting in his notice. It is
important
to the company that he trains his replacement over the next two weeks, so
they'd rather not terminate him immediatley.
So my question is, is there a way (or 3rd party product) in Windows
2000\2003 to capture\audit what files a user copies from network drives to
his local computer?
Thanks!


.



Relevant Pages

  • Re: Logging attempted access over a networked connection
    ... you have to enable auditing of object access in local security policy ... App trying to read from that same location on System A, ...
    (microsoft.public.security)
  • Re: tracking what programs are launched?
    ... You can enable auditing of object access on a computer and then audit an ... executable for the execute permission. ... Another built in method would be to enable auditing ... > that would need to be installed on the target machines. ...
    (microsoft.public.win2000.security)
  • Re: ACL Permissions
    ... Enable auditing on logon events for success and failure and privilege use ... and object access for failure. ... folder which you user could be affected by group membership. ...
    (microsoft.public.windows.server.networking)
  • Re: ACL Permissions
    ... Enable auditing on logon events for success and failure and privilege use ... and object access for failure. ... folder which you user could be affected by group membership. ...
    (microsoft.public.windows.server.security)
  • Re: ACL Permissions
    ... Enable auditing on logon events for success and failure and privilege use ... and object access for failure. ... folder which you user could be affected by group membership. ...
    (microsoft.public.windows.server.general)

Loading