0

I don't believe it's possible, though it may be, however we recently fired an employee and he was seen copying stuff from an Exchange server shortly prior to firing, is it possible to see what files were copied? The operating system is Windows Server 2008 Enterprise. Someone else claimed it was possible, and that it appears in the event log, however I can't find anything about it googling around.

1 Answer 1

1

It is possible, given that object access auditing or global object access auditing is enabled for Filesystem objects on the Exchange server in question. In that case, you would be able to track his/her attempts to access files by filtering the Security log by his/her username.

However, object access auditing is expensive, in terms of logging, because most processes running on a server interacts with the file system all the time. Thus, most organizations never enable object access auditing for file system objects on servers, unless security auditing policies specify it explicitly as a compliance requirement.

Even if object access auditing is enabled and configured for the server, you might find that the security log has been overwritten, since your former colleague copied whatever files he/she might have copied, due to the massive amount of logging this feature leads to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .