Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Following some security breach in my office and stealing data from the company, my manager gave me the task of finding all the folders on the file server which users have read access to and they didn't use that permission in the last 3 months. Is that possible without a third party software?

share|improve this question
    
I found some software called Varonis Data Advantage that gives you this feature but it costs about 80k$ per year. –  Itai Ganot Aug 15 '13 at 12:04
    
how many servers? –  tony roth Aug 15 '13 at 13:23
    
4 file servers, about 30 TB of data –  Itai Ganot Aug 15 '13 at 13:54

2 Answers 2

up vote 2 down vote accepted

You could setup auditing for the paths which should give you information (as logged events) who read folder content/when etc. which then you would somehow need to process (scripts would be a minimum) and then you would need to give it 3 months to actually build up the information.

If your company is actually putting this on the top of the priority list then I would suggest:

  1. Create a 'file/folder permission request' procedure and make sure you can maintain the information over months and years
  2. Give your users a week or two to put in formal requests to read/write certain folders
  3. Go through your file system/shares and strip out all permissions
  4. Add those for which you got formal requests

Seems draconic but if relaxed/unmaintained permissions have been at least a part of the reason why data theft in your company happened then I think it is something worth considering (highly depends on the size of your company).

share|improve this answer
    
There are about 400 employees in the company but we work with very sensitive information, so stuff like that should never happen. –  Itai Ganot Aug 15 '13 at 13:55
    
Well then that's quite a bit, especially if sensitive information is involved. I think you do need to get tougher on file permissions in general. –  hyp Aug 15 '13 at 14:16

With out a third party software less sure but yes you can give a try.

To accomplish this you will have to take a help of Auditing feature of Active directory.

By enabling Auditing you will be able to track who has accessed the file on the computer.

How to audit Folder Access. http://www.techrepublic.com/article/step-by-step-how-to-audit-file-and-folder-access-to-improve-windows-2000-pro-security/5034308

How to audit user access of Files,Folders http://support.microsoft.com/kb/310399

Hope this helps.

share|improve this answer
    
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Tom O'Connor Aug 22 '13 at 20:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.