Is there a way to monitor all read and write operations on a directory and its files in SBS 2011 (Windows Server 2008 R2)?
You can also use the built-in Access Auditing group policy settings on Server 2008 ( http://technet.microsoft.com/en-us/library/dd772630(WS.10).aspx ).
In the Group Policy editor, go to Computer Configuration | Windows Settings | Security Settings | Advanced Audit Policies - Local Group Policy Object | Object Access and enable Audit File System events (Success and Failure).
Then browse to the folder you want to monitor with Windows Explorer, Properties - Security - Advanced - Auditing and add Everyone \ Full to monitor all access.
Any attempt to access the specified folder will result in Security Event Log messsages like this:
An attempt was made to access an object. Subject: Security ID: YOURDOMAIN\USERID Account Name: USERID Account Domain: YOURDOMAIN Logon ID: 0x5057c Object: Object Server: Security Object Type: File Object Name: C:\temp\share Handle ID: 0xbf8 Process Information: Process ID: 0x12fc Process Name: C:\Windows\explorer.exe Access Request Information: Accesses: READ_CONTROL Access Mask: 0x20000
You could go as far as automating alerts by attaching a task to the specific event in the Event Viewer to send an email, launch a program, etc when the event occurs.
The SysInternals Process Monitor tool is able to log all disk access.
Getting any useful information out of this requires that you know what you're be looking for, though. The raw access log is somewhat of a firehose. :)