Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In a windows network I'd like to set up some kind of audit, to know when certain users access certain resources (e.g. copy files)

Is there a simple way to have such operations logged?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

To log incomming and outgoing connections from a network, you may want to use wireshark.

Alternatively,

Windows comes with a built-in logging suite. In windows 7 simply type logs into the start->search bar

share|improve this answer
    
For XP: support.microsoft.com/kb/310399 –  Alex Waters Aug 23 '11 at 6:48
    
I have opened the security logs and saw, for example, that a Log On event was logged when another user accessed a share on my machine. However, I could not see the share that was being accessed (the drive path). Do you think that's possible? –  w0lf Aug 23 '11 at 7:17
    
Yes, it is possible to set up individual file auditing. I recommend reading the help files –  Alex Waters Aug 23 '11 at 17:41

Process Monitor, set a filter such that Path must begin with the path your files are in.

This way, you can double click any event to see the user that caused that event...

If needed, you can also filter by certain file actions like writes and deletes if reading is just fine.

PS: Make sure the Drop Filtered Events option is enabled, you don't want to fill your memory/disk. :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.