Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to monitor all read and write operations on a directory and its files in SBS 2011 (Windows Server 2008 R2)?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

You can also use the built-in Access Auditing group policy settings on Server 2008 ( http://technet.microsoft.com/en-us/library/dd772630(WS.10).aspx ).

In the Group Policy editor, go to Computer Configuration | Windows Settings | Security Settings | Advanced Audit Policies - Local Group Policy Object | Object Access and enable Audit File System events (Success and Failure).

Then browse to the folder you want to monitor with Windows Explorer, Properties - Security - Advanced - Auditing and add Everyone \ Full to monitor all access.

Any attempt to access the specified folder will result in Security Event Log messsages like this:

An attempt was made to access an object.

Subject:
    Security ID:    YOURDOMAIN\USERID
    Account Name:   USERID
    Account Domain: YOURDOMAIN
    Logon ID:       0x5057c

Object:
    Object Server:  Security
    Object Type:    File
    Object Name:    C:\temp\share
    Handle ID:  0xbf8

Process Information:
    Process ID: 0x12fc
    Process Name:   C:\Windows\explorer.exe

Access Request Information:
    Accesses:   READ_CONTROL

    Access Mask:    0x20000

You could go as far as automating alerts by attaching a task to the specific event in the Event Viewer to send an email, launch a program, etc when the event occurs.

share|improve this answer
    
This seems like a much more robust solution, especially since Process Monitor won't show anything if the server reboots for any reason. –  Alexander Miles Jul 7 '11 at 13:45

The SysInternals Process Monitor tool is able to log all disk access.

Getting any useful information out of this requires that you know what you're be looking for, though. The raw access log is somewhat of a firehose. :)

share|improve this answer
    
I'm about to check it out in a few minutes, but will it allow me to specify a directory to watch? –  Alexander Miles Jul 6 '11 at 17:41
    
It's been a while since I've used it, but I belive you can set filters on the log, so you'd be able to filter out the results to just what you're looking for. –  EEAA Jul 6 '11 at 17:43
    
Played around with the filter, now it seems to be showing me exactly what I need it to. Anyone who gets in this folder now is toast :) –  Alexander Miles Jul 6 '11 at 17:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.