1

There is a directory on our server where we manually copy files to, and then some magical procedure runs at night to process these fiels and rename them. This was setup before I got here, and I can't seem to find where this mysterious process is located. I've searched the Scheduled Tasks on various machines and the SQL Server Agent Jobs, and I'm not sure where else to look.

What is a good, easy to use tool I could use to monitor these files and report on what process is accessing them? Or alternatively, what options does Windows Server 2003 offer for me to find this information?

1
  • Ensure logging is appropriately enabled and everything you need will be in the event logs. Apr 23, 2012 at 22:16

3 Answers 3

0

Handle by sysinternals is easy to use, and reports what process has an open file handle to a specific file. Combine it with the use of Process Explorer to get the details about the process you need

2
  • Sure- but if it's over the network, then the handle will just be attached to the process that serves the file, on the local machine.
    – mfinni
    Apr 23, 2012 at 20:41
  • These tools require someone to be watching while the process is occurring which, if I read the question correctly, I don't think will be the case here. Apr 23, 2012 at 22:16
0

If you bring up computer management, then click through to the shares section, there should be a list of "open sessions". If you're watching it when the files are updated, it should show you the remote hostname of the machine doing the editing. You may need to sort by the file you care about, since there's probably other legitimate connections open.

Note: finding out what process on a remote machine is doing it is not easy from your server - best bet is to do this once to find out what machine is doing it, then look on that machine to determine what on it is doing it.

Best of luck!

1
  • On Windows Server 2003: right click "My Computer", choose "Manage", and under "Computer Management -> System Tools -> Shared Folders" you'll want "Open Files" although "Sessions" may be useful too. Apr 24, 2012 at 0:07
0

Just use the integrated audit. This feature exists since Windows NT. With Windows 7 and 2008, some features are added: http://technet.microsoft.com/en-us/library/dd560628%28v=ws.10%29.aspx
This works only on NTFS partitions.
Just open the properties of the desired files or folders. Go to the security tab, advanced button, then auditing tab. You'll see there what you need.

Detailed instructions available in several places. For example there: http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .