Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I see the users on the server opening files and making changes on the server?

share|improve this question

migrated from stackoverflow.com Jul 4 '10 at 20:46

This question came from our site for professional and enthusiast programmers.

closed as not a real question by RobM, John Gardeniers, EEAA, splattne Jul 5 '10 at 6:28

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Fairly simple: If you trust the users, grant them access - if you don't trust them, do not give them access! –  scunliffe Jul 2 '10 at 16:58
    
I believe this question is highly dependent on what OS you run on your server –  txwikinger Jul 2 '10 at 17:19
    
Unless you are writing the server (in which case speak up), this is a Server Fault type question. It will be moved there once a quorum of user with 3k+ rep vote for that action. For future reference you might check the faq for site selection hints. –  dmckee Jul 4 '10 at 4:44
    
The use of the vbscript tag, although being completely irrelevant to the question, suggests this is a Windows environment. –  John Gardeniers Jul 4 '10 at 22:04

3 Answers 3

For Windows servers you can use DiskPulse, which is capable of monitoring file systems and showing all changes in real-time.

http://www.diskpulse.com

share|improve this answer

sar is probably the closest existing utility that does what you want. If you are using the grsecurity patches on your kernel, you could place the machine in gbac audit mode and log the data that way.

share|improve this answer

You can enable file-level auditing on Windows through the security event log.

Goto to your local security policy in the computer management MMC, in Local policies, then Audit Policies, enable 'audit object access' so successful (or failed) access is recorded. Here's a MS support article about it.

If you enable audits on success, then expect to see a lot of entries in your security event log.

An alternative is to run an intrusion detection system like Aide regularly to see what files have been changed since the last run.

share|improve this answer