Is there a way to monitor all read and write operations on a directory and its files in SBS 2011 (Windows Server 2008 R2)?


You can also use the built-in Access Auditing group policy settings on Server 2008 ( http://technet.microsoft.com/en-us/library/dd772630(WS.10).aspx ).

In the Group Policy editor, go to Computer Configuration | Windows Settings | Security Settings | Advanced Audit Policies - Local Group Policy Object | Object Access and enable Audit File System events (Success and Failure).

Then browse to the folder you want to monitor with Windows Explorer, Properties - Security - Advanced - Auditing and add Everyone \ Full to monitor all access.

Any attempt to access the specified folder will result in Security Event Log messsages like this:

An attempt was made to access an object.

    Account Name:   USERID
    Account Domain: YOURDOMAIN
    Logon ID:       0x5057c

    Object Server:  Security
    Object Type:    File
    Object Name:    C:\temp\share
    Handle ID:  0xbf8

Process Information:
    Process ID: 0x12fc
    Process Name:   C:\Windows\explorer.exe

Access Request Information:
    Accesses:   READ_CONTROL

    Access Mask:    0x20000

You could go as far as automating alerts by attaching a task to the specific event in the Event Viewer to send an email, launch a program, etc when the event occurs.

  • This seems like a much more robust solution, especially since Process Monitor won't show anything if the server reboots for any reason. – Bender the Greatest Jul 7 '11 at 13:45

The SysInternals Process Monitor tool is able to log all disk access.

Getting any useful information out of this requires that you know what you're be looking for, though. The raw access log is somewhat of a firehose. :)

  • I'm about to check it out in a few minutes, but will it allow me to specify a directory to watch? – Bender the Greatest Jul 6 '11 at 17:41
  • It's been a while since I've used it, but I belive you can set filters on the log, so you'd be able to filter out the results to just what you're looking for. – EEAA Jul 6 '11 at 17:43
  • Played around with the filter, now it seems to be showing me exactly what I need it to. Anyone who gets in this folder now is toast :) – Bender the Greatest Jul 6 '11 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.