0

Is it possible to make a Windows Server (2012) log into a file (all-files-accessed.log) all read (and write) operations that users make on the file system, hereunder:

  • What file was read
  • Username of person who read the file
  • Date and time the file was read
Improve this question
2
  • 5
    Does it need to be a text file? The built in filesystem auditing does this, but logs into the Windows security log, not a file.
    – Shane Madden
    Feb 10, 2014 at 20:53
  • Make sure you have lots of disk space, too. This level of logging chews up disk space about as fast as capturing HD video.
    – HopelessN00b
    Feb 10, 2014 at 22:12

1 Answer 1

Reset to default
4

As mentioned by Shane, you need to configure auditing. If it's only one server, you should be able to set auditing at the root of the drive, for each folder. Right click>Properties>Security>Advanced>Auditing tab.

If for multiple servers, you'll want to setup a GPO.

Auditing file systems is a BIG task, and requires a lot of planning. It's not something you should just enable across an entire server as it WILL cause performance issues if there are multiple concurrent access requests. You'll need a dedicated logging drive for your security logs, as they will grow faster than you can imagine which will cause Windows to run out of drive space if you don't move them. Read this from technet for more info.

If you really need to export everything to a text file, rather than using Windows logs, you can export windows logs by right clicking and then saving all events as a text file.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.