We're having issues with people moving files both intentionally and accidentally on a networked drive. What would be a good way to establish accountability without bogging down the storage server? Is there a lightweight way to log file move actions? The only solution I am aware of is NTFS logging and that seems too resource intensive.
closed as not a real question by SvW, Ward, rnxrx, Michael Hampton, HopelessN00b Aug 29 '12 at 23:54
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
If you don't want people to be able to move files either intentionally or accidentally, then don't grant them the rights to do so.
If you do want them to have those rights, and be able to find out who did what and when, then you may have to look at NTFS auditing, but be aware that this can generate huge amounts of log data, especially if you're auditing successful operations (which you will need if you want to find out who moved or deleted something).
You can "establish accountability" using native Windows tools and enabling object access auditing. This can be done either via GPO, or by local security policy. Once you've done that, incidents of users deleting files and moving files will be tracked in the server's Security log. You can scope the object access auditing to only certain areas/files on the file server.