Windows Network resource access audit

Question

In a windows network I'd like to set up some kind of audit, to know when certain users access certain resources (e.g. copy files)

Is there a simple way to have such operations logged?

Alex Waters · Answer 1 · 2011-08-23 06:40:02Z

up vote 0 down vote accepted

To log incomming and outgoing connections from a network, you may want to use wireshark.

Alternatively,

Windows comes with a built-in logging suite. In windows 7 simply type logs into the start->search bar

answered Aug 23 '11 at 6:40

	For XP: support.microsoft.com/kb/310399 – Alex Waters Aug 23 '11 at 6:48
	I have opened the security logs and saw, for example, that a Log On event was logged when another user accessed a share on my machine. However, I could not see the share that was being accessed (the drive path). Do you think that's possible? – w0lf Aug 23 '11 at 7:17
	Yes, it is possible to set up individual file auditing. I recommend reading the help files – Alex Waters Aug 23 '11 at 17:41

feedback

Tom Wijsman · Answer 2 · 2011-08-23 23:46:26Z

Process Monitor, set a filter such that Path must begin with the path your files are in.

This way, you can double click any event to see the user that caused that event...

If needed, you can also filter by certain file actions like writes and deletes if reading is just fine.

PS: Make sure the Drop Filtered Events option is enabled, you don't want to fill your memory/disk. :)

2 Answers