i have an employee that left the company yesterday, someone told me he copied a bunch of stuff from his assigned windows pc. Is there a way i can check what he copied ?

2 Answers 2


The only way would be if you already had file and folder auditing enabled and configured.

  • Hello joe! how do i implement this auditing for the future?
    – Ernest
    Mar 30, 2011 at 14:05
  • And that would not tell you the difference between "copied" and "opened".
    – mfinni
    Mar 30, 2011 at 14:14

Sorry, but there's no way to determine this. You can safely assume that the person copied everything they had access to.

If this issue is important to your company, they will need to look at a document management system that utilizes a versioning check-out/check-in based strategy. In this scenario, users are not allowed to access raw file shares and would need to use the client software to access files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.