Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There is a directory on our server where we manually copy files to, and then some magical procedure runs at night to process these fiels and rename them. This was setup before I got here, and I can't seem to find where this mysterious process is located. I've searched the Scheduled Tasks on various machines and the SQL Server Agent Jobs, and I'm not sure where else to look.

What is a good, easy to use tool I could use to monitor these files and report on what process is accessing them? Or alternatively, what options does Windows Server 2003 offer for me to find this information?

share|improve this question
    
Ensure logging is appropriately enabled and everything you need will be in the event logs. –  John Gardeniers Apr 23 '12 at 22:16

3 Answers 3

Handle by sysinternals is easy to use, and reports what process has an open file handle to a specific file. Combine it with the use of Process Explorer to get the details about the process you need

share|improve this answer
    
Sure- but if it's over the network, then the handle will just be attached to the process that serves the file, on the local machine. –  mfinni Apr 23 '12 at 20:41
    
These tools require someone to be watching while the process is occurring which, if I read the question correctly, I don't think will be the case here. –  John Gardeniers Apr 23 '12 at 22:16

If you bring up computer management, then click through to the shares section, there should be a list of "open sessions". If you're watching it when the files are updated, it should show you the remote hostname of the machine doing the editing. You may need to sort by the file you care about, since there's probably other legitimate connections open.

Note: finding out what process on a remote machine is doing it is not easy from your server - best bet is to do this once to find out what machine is doing it, then look on that machine to determine what on it is doing it.

Best of luck!

share|improve this answer
    
On Windows Server 2003: right click "My Computer", choose "Manage", and under "Computer Management -> System Tools -> Shared Folders" you'll want "Open Files" although "Sessions" may be useful too. –  Jon Kloske Apr 24 '12 at 0:07

Just use the integrated audit. This feature exists since Windows NT. With Windows 7 and 2008, some features are added: http://technet.microsoft.com/en-us/library/dd560628%28v=ws.10%29.aspx
This works only on NTFS partitions.
Just open the properties of the desired files or folders. Go to the security tab, advanced button, then auditing tab. You'll see there what you need.

Detailed instructions available in several places. For example there: http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.