Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

We're having issues with people moving files both intentionally and accidentally on a networked drive. What would be a good way to establish accountability without bogging down the storage server? Is there a lightweight way to log file move actions? The only solution I am aware of is NTFS logging and that seems too resource intensive.

share|improve this question
3  
Seriously? You can't give us any more details? What kind of storage server is it? Help us help you man. – Ryan Ries May 22 '12 at 14:41
@RyanRies updated with appropriate tags. – emd May 22 '12 at 14:44
1  
What exactly do you want to do? Log file moves? Prevent file moves? Still more info needed.. – MichelZ May 22 '12 at 14:46

closed as not a real question by SvW, Ward, rnxrx, Michael Hampton, HopelessN00b Aug 29 '12 at 23:54

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

2 Answers

up vote 1 down vote

If you don't want people to be able to move files either intentionally or accidentally, then don't grant them the rights to do so.

If you do want them to have those rights, and be able to find out who did what and when, then you may have to look at NTFS auditing, but be aware that this can generate huge amounts of log data, especially if you're auditing successful operations (which you will need if you want to find out who moved or deleted something).

share|improve this answer
The users need the ability to create, delete and move files otherwise they wouldn't have the ability – emd May 22 '12 at 14:44
Edited accordingly – Chris McKeown May 22 '12 at 14:49
Is there any alternative to ntfs logging? I'm aware of that solution already, I was hoping someone had a better idea. – emd May 22 '12 at 14:50
Might have helped if you said that in your original question! Perhaps edit your question to help others to help you. – Chris McKeown May 22 '12 at 14:51
up vote 1 down vote

You can "establish accountability" using native Windows tools and enabling object access auditing. This can be done either via GPO, or by local security policy. Once you've done that, incidents of users deleting files and moving files will be tracked in the server's Security log. You can scope the object access auditing to only certain areas/files on the file server.

share|improve this answer
How does this affect performance? – emd May 22 '12 at 15:24
It has an impact but exactly how much of an impact depends entirely on your environment. Common sense applies in planning out your directory structure for simplicity (fewer ACL calculations, etc.) and scoping the access auditing appropriately. – Ryan Ries May 22 '12 at 15:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.