1

Is there a way to log users upon accessing shared folders in Windows Server? My goal is to write a program that sort of runs in the background monitoring the shared folders and logs user information whenever someone accesses the folder. How do I go about implementing it? What tools I should use to achieve this? Thanks in advance

I'm aware of the file auditing functionality provided by Windows. As Kyle Smith suggested this probably would become a nightmare to dig through tons of log entries to find relevant ones.It is also inefficient. So my question is how do I do this other than enabling "object access auditing". I need to implement this for both Windows Server 2003 & 2008

1
  • Think about it from the perspective of the OS on the server computer -- All it "sees" are requests by remote users to "open", "close", "read", "write", etc. It has no idea what application is running on the client, nor what that application intends by the operation it invokes. Oct 16, 2009 at 18:42

3 Answers 3

2

This can be done using Windows logging by going to Administrative Tools > Local Security Policy > Security Settings > Local Policies > Audit Policy and setting "Audit object access" to some value other than "No auditing." (Default)

Digging through these logging entries, on the other hand, will be a nightmare.

1
  • +1 - Nobody ever gets what they want out of object access auditing in Windows, because it's done at the filesystem API level. You get a lot of logs of "open", "close", etc, but not a clear log of events like "User xxx opened yyy file with Microsoft Word". Unfortunately, that's just the way the product works. Oct 16, 2009 at 18:41
0

You want to enable file auditing as per this article on 2003. You don't say what version of Windows, but it's similar in 2008.

0

I think I found an answer http://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher.aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .