How to log when a file is accessed on server share? Win Server 2008. Student needing help!

Question

Hi All I am a student in a Information Technology Program and I need a little help.

ISSUE CLIFF NOTES

1. Have a few files in a share folder on a server that need logged when they are opened and by what computer on the network.
2. Need to be able to filter by computer user and what files they opened. There is about 6 "bait" files mixed throughout 30.
3. Need to be able to out put the information to some kind of text file.
4. Thank you for any wisdom or guidance.

ISSUE

I need help to set up a audit log that will audit and list when ever someone on our network access a file on our class server's share drive. I am learning this stuff and more server in the next few weeks but this issue cant wait that long. Fairly detailed instructions would be great but I can work in the server environment so you are working with some one that is a Tech. I have gone through share management and than just taken pictures of the unauthorized access that i was watching while i sat there but i need it to log for me. Our class room is on its own network subnet so we are pretty much our own network with 30 desktop computers and 1 server/Instructor computer running windows 2008 server. The rest of the computers are windows 7.

Background

Right now i am learning Windows 7 configuration but the problem is other students are copying my lab work after i submit it to my prof's share drive on our class server (Windows Server 2008). I have talked to the prof and he is aware of it and wants to get the cheating stopped but we need the proof to really nail the people. Thank you all for any help you can give me, I work really hard for my marks and it hurts when you find out you have 4 or 5 other people just copying it.

Answer 1

Having just completed a long stint as an academic system administrator, I know full well how versatile Windows permissioning can be if done right. But first, to answer the question as asked.

Windows does indeed have the capabilities to log accesses to files. It is extremely spammy, and requires automated log-analysis to get anything useful out of them. There are a variety of tools to do so. Splunk (I'm sure you've seen the ads on this site about them) is perhaps the top of the line. At the bottom of the list are scripts that scrape the Windows Security Event Log for interesting events.

PowerShell has ways of querying this information (get-eventlog). On Server 2008 you have access to wevtutil which is a tool that can query log-data using xpath formatted strings (hard to master, but useful to know) and dump into XML files for analysis. There are a few questions on ServerFault that relate to this sort of analysys.

---

Now for the actual answer to the problem as presented.

Since this is on a Windows server, you can use some custom NTFS rights to better pare down what students can and can't do in a directory. You have to pay attention to rights inheritance to make this work, but dropboxes can indeed be created safely. We were using them quite happily in certain areas.

The core concepts for correct permissioning of file drop-box directories:

• Students need to be able to browse to the directory.
• Inherited rights must be blocked, as they should not be allowed to browse any directory below the drop-box directory.
• Students need the ability to write any file or directory, but only read files and directories they create.
• The teaching staff needs to be able to read anything.

Practically, this can be accomplished through the Windows GUI or the icacls tool. Since icacls is vastly easier to document on a site like this, that's what I'll provide.

icacls dropdir /inheritance:d 
icacls dropdir /remove AllStudents
icacls dropdir /grant Csci101:(rx,wd)
icacls dropdir /grant CSciFaculty:(OI)(CI)(M)
icacls dropdir /grant *S-1-3-0:(oi)(ci)(rx)

The above lines do the following, in order.

1. Block inheritance, copying any existing ACLs
2. Removes the student group from the existing ACLs. Repeat as needed for any other groups that might grant visibility into the directory.
3. Grant the class-group the ability to read-execute and write-data on the directory itself. This does not grant any ability to view any files in this directory, just write them.
4. Grant the faculty the ability to modify content in the directory and all sub-directories
5. Grant the CREATOR_OWNER user (a special NTFS user that allows granting rights to the Owners of files) the ability to read created files.

This will allow students to copy in files, not be able to modify them once copied in, and only view their own files. If a student attempts to copy over an existing file, they will get an access-denied error. If a student attempts to open a file they know is there but do not have rights to it, they will get an access-denied error.

Obviously, this does require some infrastructure:

• A group containing all students in a class
• A group containing all the faculty for the class

This will make it a LOT harder to grab files students shouldn't be grabbing.