Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i have an employee that left the company yesterday, someone told me he copied a bunch of stuff from his assigned windows pc. Is there a way i can check what he copied ?

share|improve this question

2 Answers 2

The only way would be if you already had file and folder auditing enabled and configured.

share|improve this answer
    
Hello joe! how do i implement this auditing for the future? –  Ernest Mar 30 '11 at 14:05
    
And that would not tell you the difference between "copied" and "opened". –  mfinni Mar 30 '11 at 14:14

Sorry, but there's no way to determine this. You can safely assume that the person copied everything they had access to.

If this issue is important to your company, they will need to look at a document management system that utilizes a versioning check-out/check-in based strategy. In this scenario, users are not allowed to access raw file shares and would need to use the client software to access files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.