Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have multiple shared folders on Windows SBS 2008 server. I need to be able to tell if a domain user is accessing these shares and copying large quantities of files to their laptop. Is there a way of turning on auditing in group policy to log an event if this occurs. Or better still can I be alerted by email if this kind of activity occurs?



share|improve this question
up vote 0 down vote accepted

I would forward the logs / audits to a central log server and filter out the "copy" keyword. But you could find something more native for windows. Such as kiwi (Syslog replacements for windows)

And yes, in most of the cases you can send an email if an event is happening a lot of times (30 copies in 1 minute for example)

You could also monitor the network traffic of the server, and if an ip has a lot of traffic, just block it. {Also in combination with audits you can get both the ip and the username of the leacher :>}

share|improve this answer
Hi Thanks for your response, I will take a look at Kiwi, see if that will fit my needs – heisenberg Aug 24 '10 at 8:53
Otherwise you can use syslog agent in order to forward your logs – Nikolaidis Fotis Aug 24 '10 at 9:00
Thanks for your help – heisenberg Aug 30 '10 at 16:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.