I have a Windows Server 2012 R2 box with file server role installed (FSRM, DFS Namespaces, DFSR). One folder from the DFS namespace increased substantially in size in the last two days. The folder has many, many subfolders and so on. I wanted to check whats going on there, what are the new files, maybe also who is addind files there. I can set the auditing settings to everyone in the folder, but it spits too much information in the security log, not really practical I think. I don't really have any third party tool installed. Is there a easier way to collect this kind of information? Maybe a Powershell script getting the last written files?

  • Like a recursive folder search for files newer than $date, for example? – HopelessN00b Nov 21 '14 at 16:19
  • Well, exactly, something like "$Files = Get-ChildItem $Path -Recurse | ? {$_.CreationTime -gt $Date} | Sort CreationTime" – esserafael Nov 22 '14 at 23:25
  • Sure, like that. So, uh, what's wrong with that? – HopelessN00b Nov 25 '14 at 20:47

The Security Event Log and auditing object access would be the "supported" way to do this w/o adding third-party software. There's no built-in functionality, otherwise, that would do what you're looking for.

Searching for files by date isn't a bad idea (you could get a Win32 port of the Unix find utility to help with that) but you can't absolutely guarantee that a user hasn't altered the modification time on a file. It's not 100% foolproof like the Security Event Log would be, but it's not unreasonable.

If the folders you're talking about are being replicated by DFS-R I suppose you could use the DFS-R logs (in %SystemRoot%\System32\Debug) to try to track new file creations (by way of their replication events), too.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.