Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to log users upon accessing shared folders in Windows Server? My goal is to write a program that sort of runs in the background monitoring the shared folders and logs user information whenever someone accesses the folder. How do I go about implementing it? What tools I should use to achieve this? Thanks in advance

I'm aware of the file auditing functionality provided by Windows. As Kyle Smith suggested this probably would become a nightmare to dig through tons of log entries to find relevant ones.It is also inefficient. So my question is how do I do this other than enabling "object access auditing". I need to implement this for both Windows Server 2003 & 2008

share|improve this question
Think about it from the perspective of the OS on the server computer -- All it "sees" are requests by remote users to "open", "close", "read", "write", etc. It has no idea what application is running on the client, nor what that application intends by the operation it invokes. – Evan Anderson Oct 16 '09 at 18:42

This can be done using Windows logging by going to Administrative Tools > Local Security Policy > Security Settings > Local Policies > Audit Policy and setting "Audit object access" to some value other than "No auditing." (Default)

Digging through these logging entries, on the other hand, will be a nightmare.

share|improve this answer
+1 - Nobody ever gets what they want out of object access auditing in Windows, because it's done at the filesystem API level. You get a lot of logs of "open", "close", etc, but not a clear log of events like "User xxx opened yyy file with Microsoft Word". Unfortunately, that's just the way the product works. – Evan Anderson Oct 16 '09 at 18:41

You want to enable file auditing as per this article on 2003. You don't say what version of Windows, but it's similar in 2008.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.