There is a directory on our server where we manually copy files to, and then some magical procedure runs at night to process these fiels and rename them. This was setup before I got here, and I can't seem to find where this mysterious process is located. I've searched the Scheduled Tasks on various machines and the SQL Server Agent Jobs, and I'm not sure where else to look.

What is a good, easy to use tool I could use to monitor these files and report on what process is accessing them? Or alternatively, what options does Windows Server 2003 offer for me to find this information?

  • Ensure logging is appropriately enabled and everything you need will be in the event logs. – John Gardeniers Apr 23 '12 at 22:16

Handle by sysinternals is easy to use, and reports what process has an open file handle to a specific file. Combine it with the use of Process Explorer to get the details about the process you need

| improve this answer | |
  • Sure- but if it's over the network, then the handle will just be attached to the process that serves the file, on the local machine. – mfinni Apr 23 '12 at 20:41
  • These tools require someone to be watching while the process is occurring which, if I read the question correctly, I don't think will be the case here. – John Gardeniers Apr 23 '12 at 22:16

If you bring up computer management, then click through to the shares section, there should be a list of "open sessions". If you're watching it when the files are updated, it should show you the remote hostname of the machine doing the editing. You may need to sort by the file you care about, since there's probably other legitimate connections open.

Note: finding out what process on a remote machine is doing it is not easy from your server - best bet is to do this once to find out what machine is doing it, then look on that machine to determine what on it is doing it.

Best of luck!

| improve this answer | |
  • On Windows Server 2003: right click "My Computer", choose "Manage", and under "Computer Management -> System Tools -> Shared Folders" you'll want "Open Files" although "Sessions" may be useful too. – Jon Kloske Apr 24 '12 at 0:07

Just use the integrated audit. This feature exists since Windows NT. With Windows 7 and 2008, some features are added: http://technet.microsoft.com/en-us/library/dd560628%28v=ws.10%29.aspx
This works only on NTFS partitions.
Just open the properties of the desired files or folders. Go to the security tab, advanced button, then auditing tab. You'll see there what you need.

Detailed instructions available in several places. For example there: http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.