Hello Friends, I have a windows 2008 r2 OS, we have 2 administrators here, i would like to know information about a person who got connected to the server remotely and copied a file onto his system. Can i find out the name of computer onto which the file was copied or logs in which i can go through to get some details about that computer or its MAC address. Thank You

You can enable Security auditing to get some basic information. But not a detailed one.. http://technet.microsoft.com/en-us/library/dd560628(WS.10).aspx Santhosh Sivarajan | MCTS, MCSE (W2K3/W2K/NT4), MCSA (W2K3/W2K/MSG), CCNA, Network+ Houston, TX Blogs - http://blogs.sivarajan.com/ Articles - http://www.sivarajan.com/publications.html Twitter: @santhosh_sivara - http://twitter.com/santhosh_sivara This posting is provided AS IS with no warranties, and confers no rights.

Hello, as far as i know there is no way to track down who has copied a file to another location, especially not to which machine. If a file is opened in WORD for example and the user use the "save as" option the server can't realize that it is safed to another place. So if you decide users have read access to a resource then you also allow them to copy the data without recognizing it. To prevent this don't give them read access.Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.