Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows XP machine with several Samba shares. Is it possible to obtain a log of all files that have been accessed on that machine via Samba?

share|improve this question
up vote 1 down vote accepted

If you want to do it for security purposes, you can use auditing. However, it does not log access to samba, but to a file object (regardless whether access was local or remote).

You can enable it as:

  1. Go into Local Security policy
    • Go to Security settings, Local policies, Audit policy, Audit object access
    • Choose whether you want to audit successful file access or failed one (or both)
  2. For each file (or folder) you want to track you need to set auditing
    • Right-click Properties, Security tab
    • Go into Advanced, Auditing tab
    • Add user/group that you want to audit (Everyone?)
  3. Check event log for traces.

P.S. You might check Microsoft's TechNet article also. It says same thing, but with pictures. :)

share|improve this answer
pictures are awesome, thanks for the help :) – Dustin Jul 22 '11 at 15:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.