I want to be able to know who and when touched a file. My last question showed that I can't rely on NTFS.
Tell me more
×
Server Fault is a question and answer site for
professional system and network administrators. It's 100% free, no registration required.
|
|
||||
|
|
The implementation to this is different according to your infrastructure, but the answer (in principal) is the same. Time to implement File Auditing. If you're talking about shares on a Windows server, then you should implement File Auditing via GPO. If you're concerned about a Windows workstation, this can be implemented via Local Security Policy |
||||
|
|
|
You should be able to turn file access auditing on. This is different than looking at the modified date/time. The following page has a really good writeup: http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access |
|||
|
|
|
You will probably want to just take the next logical leap and look in the direction of the so-called Host-Based Intrusion Detection Systems (HIDS), which, as one of their features, offer setting up file monitoring. I can't recommend any HIDS for Windows, but you should be able to find something to suit your needs. |
|||
|
|
|
Check out "neologger" Official Website http://www.bsk-consulting.de/neologger-windows-syslog-logger-tool/ Sourceforge Website http://sourceforge.net/projects/neologger/ |
|||
|
|
|
You can track file system changes with recent versions of Splunk. The free version will let you index up to 500MB daily, which should be sufficient for most file-system changes. Info on how it does this at: http://www.splunk.com/base/Documentation/3.4.10/Admin/FileSystemChangeMonitor |
|||
|
|
|
You could try Power Admin File Sight. There's a 30-day trial available and if you decide to purchase it's not hugely expensive. |
|||
|
|
