Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to determine if a particular file was accessed in the last, say, 2 days.

Is this possible on Windows Server 2008 R2?

share|improve this question

5 Answers 5

up vote 6 down vote accepted

After that fact? No, I do not believe so unless an auditing ACL was inherited from a parent or set directly on the file for the "read file" permission. If you DO enable file system auditing, you can then look at the security logs to find this information which most people will pipe or transfer to some kind of tool for parsing.

You can also take a look at using something like Tripwire for maintaining file integrity if that becomes a goal.

share|improve this answer
    
is it possible to make without using third-party utilities? windows tracks creation time, modification time, why it can't track "read time"? –  javapowered Jan 20 '12 at 8:29
    
@javapowered Yes it is. As SpacemanSpiff mentioned. Use built in auditing. Read this: technet.microsoft.com/en-us/library/dd560628%28v=ws.10%29.aspx –  Tom Jan 20 '12 at 11:08
    
@Tom thanks Tom, however linked article is pretty long and complicated. i'm not proffesional system administrator, it would be nice if someone can link easy step-by-step howto "audit access to particular file" –  javapowered Jan 20 '12 at 14:27
1  
and.... be careful setting auditing at the root of a drive, it will likely cascade down and your log will go insane. fyi. –  SpacemanSpiff Jan 20 '12 at 14:31
1  
Open Administrative tools, Event Viewer, and look at the security log –  SpacemanSpiff Jan 20 '12 at 15:35

Actually there is a way but it's been disabled by default since Vista/2008 and I just verified it's disabled by default in Win7/2008R2.

The registry setting NtfsDisableLastAccessUpdate located in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem now defaults to 1 for performance purposes. If you change that to a 0 then NTFS will update the LastAccessTime property of the file/folder.

You can see this value by looking at the properties of the file/folder or you can pull the information with a PowerShell script. Make sure you test first though to ensure the performance hit isn't too bad.

Also NTFS won't always update the information imediately. According to this http://msdn.microsoft.com/en-us/library/windows/desktop/ms724290(v=vs.85).aspx it could take up to an hour.

share|improve this answer
1  
That's great to know, does it store who accessed it as well? –  SpacemanSpiff Jan 22 '12 at 21:32
1  
No, just when it was accessed. If you need to know who then you'll need to enable auditing as mentioned in another answer. –  murisonc Jan 25 '12 at 1:34
    
@murisonc, Couldn't the malicious user simply use a program which restores the last accessed date back to the original value after it has accessed the files? –  Pacerier Nov 22 at 16:10
    
@Pacerier, I'm sure a malicious user could find a way to forge it. To catch that you would have to enable auditing and make sure those audit entries are being forwarded to an audit collection sever. –  murisonc 2 days ago

As @murisonc pointed out, NTFS volumes on Windows can track the last access time, they just don't by default, and it is easily enabled by setting a registry key.

You can combine this with a file integrity monitoring tool, such as Verisys or Tripwire, which can provide automated alerting and reporting.

Filesystem auditing tools may be an option too, though many rely on enabling object auditing, which can kill performance. Some others rely on filesystem filter drivers instead, but these drivers can be a bit flakey.

share|improve this answer

This Guide should do the trick to enable audit on a file: http://www.discoveryourpc.net/2010/01/auditing-access-to-files-on-windows-7.html

It's for Windows 7 but is almost identical to 2008.

You could also use group policies for this. But as you stated you are not a professional admin this would not be the way for you.

You need to add a user or group to audit. I recommend adding the same group which has access on the parent folder.

You have to inform the users what you audit. In your case "file access". If you don't inform them the auditing could be illegal.

share|improve this answer
    
Thanks. i did exactly as you asked and it worked perfectly! Only issue is, it doesn't show the logs for before i enabled the audit access. How do i get it to do that? –  user203207 Dec 20 '13 at 18:02

You can refer this article http://www.morgantechspace.com/2013/11/Enable-File-System-Auditing-in-Windows.html to know about file system auditing

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.