Re: User activity log

You can enable auditing of object access in Local Security Policy or the
domain level Group Policy enforcing such settings and then audit
folders/files you want to track. For instance you can audit an executable
for when a user executes the file and folders for when users have deleted
files or created files. However auditing everything will create a tremendous
amounts of entries for object access in the security log and impact computer
performance. It is best to audit only the bare number of objects, for the
bare number of permissions, for the bare number or users avoiding
everyone/users/authenticated users groups if possible. The links below
explains more. Event Comb can help you parse security logs for needed
info. --- Steve.

http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
http://www.microsoft.com/technet/security/topics/auditingandmonitoring/securitymonitoring/smpgch04.mspx

"LordShark" <TonyYug@xxxxxxxxx> wrote in message
news:1144110408.914374.237340@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi

I am using Windows Server 2003 Enterprise Edition and wondering if
there is a log file or anything that will give me information on remote
user activity (what applications ran, files copied, deleted ...) Any
help is appreciated.

Thanks
LS



.

Relevant Pages

  • Re: How to determine who changed permissions on a directory?
    ... I used the "Security Monitoring and Attack Detection Planning Guide" from ... Audit Account Logon events - Success, Failure ... Audit Object Access - Success, ...
    (microsoft.public.security)
  • Re: How to determine who changed permissions on a directory?
    ... I used the "Security Monitoring and Attack Detection Planning Guide" from ... Audit Account Logon events - Success, Failure ... Audit Object Access - Success, ...
    (microsoft.public.security)
  • Re: Track Changes to IP Configuration?
    ... You could enable auditing of object access and then audit the registry key ... security logs for event IDs and text strings. ... Set key value. ...
    (microsoft.public.windows.server.security)
  • RE: Windows Event 560
    ... You are probaly getting these events becuase you have your security policy ... set to audit object access. ... Security Event Log object access ...
    (Security-Basics)
  • Re: Activity monitoring in my pc
    ... You can enable auditing of object access and then audit specific ... folders/files, however that will only tell you who accessed a file since ...
    (microsoft.public.win2000.security)