Guest mike Posted July 27, 2007 Posted July 27, 2007 I have a situation where several files got moved, but I cannot track which user did it. I have a timestamp, but the security logs do no really show or indicate where this came from. Does Window shave this functioality native? If not which 3rd party products would? thanks in advance for any replies
Guest Kevinm Posted July 27, 2007 Posted July 27, 2007 Re: how can I log when a user moves a file? Windows does not natively do this. Your best options would be to limit access to the files, or install a file monitoring solution. I believe that http://www.quest.com has a solution that will do this for you. -- ~Kevinm WLKMMAS [x-MVP] "mike" <mike@discussions.microsoft.com> wrote in message news:31E22C07-41DE-4048-908F-2A5365BD8B0A@microsoft.com... I have a situation where several files got moved, but I cannot track which user did it. I have a timestamp, but the security logs do no really show or indicate where this came from. Does Window shave this functioality native? If not which 3rd party products would? thanks in advance for any replies
Guest mike Posted July 31, 2007 Posted July 31, 2007 Re: how can I log when a user moves a file? I didn't think there was a 'native' way, but wanted to check, thanks! "Kevinm" wrote: > Windows does not natively do this. Your best options would be to limit access to the files, or install a file monitoring solution. I believe that http://www.quest.com has a solution that will do this for you. > > -- > ~Kevinm WLKMMAS [x-MVP] > "mike" <mike@discussions.microsoft.com> wrote in message news:31E22C07-41DE-4048-908F-2A5365BD8B0A@microsoft.com... > I have a situation where several files got moved, but I cannot track which > user did it. I have a timestamp, but the security logs do no really show or > indicate where this came from. Does Window shave this functioality native? If > not which 3rd party products would? thanks in advance for any replies
Guest Atlan Posted July 31, 2007 Posted July 31, 2007 Re: how can I log when a user moves a file? Hi Mike, if files are moved then the OS handles that as a move in the file system (very quick). But from the security view it is handled as they are copied and deleted. So if you are watching these files with the monitoring mechanisms of NTFS security then you will see the changes in the security section of the eventlog. You can simply watch for "delete" in the extended security dialog and will see that events are reported including the user who did it. Best regards, Holger
Recommended Posts