Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to be able to know who and when touched a file. My last question showed that I can't rely on NTFS.

share|improve this question
    
I'm not sure why you tink you can't relay on NTFS as long as you take regular security precautions none of the utilities mentioned have to be allowed on the system. You can turn on auditing but it's overkill depending on the situation. More details in both questions would help. –  Jim B Jul 8 '09 at 4:19
add comment

6 Answers

The implementation to this is different according to your infrastructure, but the answer (in principal) is the same. Time to implement File Auditing.

If you're talking about shares on a Windows server, then you should implement File Auditing via GPO. If you're concerned about a Windows workstation, this can be implemented via Local Security Policy

share|improve this answer
add comment

You should be able to turn file access auditing on. This is different than looking at the modified date/time. The following page has a really good writeup: http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access

share|improve this answer
add comment

You will probably want to just take the next logical leap and look in the direction of the so-called Host-Based Intrusion Detection Systems (HIDS), which, as one of their features, offer setting up file monitoring.

I can't recommend any HIDS for Windows, but you should be able to find something to suit your needs.

share|improve this answer
add comment

You can track file system changes with recent versions of Splunk. The free version will let you index up to 500MB daily, which should be sufficient for most file-system changes.

Info on how it does this at: http://www.splunk.com/base/Documentation/3.4.10/Admin/FileSystemChangeMonitor

share|improve this answer
add comment

You could try Power Admin File Sight. There's a 30-day trial available and if you decide to purchase it's not hugely expensive.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.