Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a windows network I'd like to set up some kind of audit, to know when certain users access certain resources (e.g. copy files)

Is there a simple way to have such operations logged?

share|improve this question
up vote 0 down vote accepted

To log incomming and outgoing connections from a network, you may want to use wireshark.


Windows comes with a built-in logging suite. In windows 7 simply type logs into the start->search bar

share|improve this answer
For XP: – Alex Waters Aug 23 '11 at 6:48
I have opened the security logs and saw, for example, that a Log On event was logged when another user accessed a share on my machine. However, I could not see the share that was being accessed (the drive path). Do you think that's possible? – w0lf Aug 23 '11 at 7:17
Yes, it is possible to set up individual file auditing. I recommend reading the help files – Alex Waters Aug 23 '11 at 17:41

Process Monitor, set a filter such that Path must begin with the path your files are in.

This way, you can double click any event to see the user that caused that event...

If needed, you can also filter by certain file actions like writes and deletes if reading is just fine.

PS: Make sure the Drop Filtered Events option is enabled, you don't want to fill your memory/disk. :)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .