Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have an employee that left the company yesterday, someone told me he copied a bunch of stuff from his assigned windows pc. Is there a way i can check what he copied ?

share|improve this question

The only way would be if you already had file and folder auditing enabled and configured.

share|improve this answer
Hello joe! how do i implement this auditing for the future? – Ernest Mar 30 '11 at 14:05
And that would not tell you the difference between "copied" and "opened". – mfinni Mar 30 '11 at 14:14

Sorry, but there's no way to determine this. You can safely assume that the person copied everything they had access to.

If this issue is important to your company, they will need to look at a document management system that utilizes a versioning check-out/check-in based strategy. In this scenario, users are not allowed to access raw file shares and would need to use the client software to access files.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.