View log of files accessed via Samba on Windows XP machine

Question

I have a Windows XP machine with several Samba shares. Is it possible to obtain a log of all files that have been accessed on that machine via Samba?

Answer 1

If you want to do it for security purposes, you can use auditing. However, it does not log access to samba, but to a file object (regardless whether access was local or remote).

You can enable it as:

1. Go into Local Security policy
   • Go to Security settings, Local policies, Audit policy, Audit object access
   • Choose whether you want to audit successful file access or failed one (or both)
2. For each file (or folder) you want to track you need to set auditing
   • Right-click Properties, Security tab
   • Go into Advanced, Auditing tab
   • Add user/group that you want to audit (Everyone?)
3. Check event log for traces.

P.S. You might check Microsoft's TechNet article also. It says same thing, but with pictures. :)