File Copy Logs

Hello everyone,

I'm hoping I can find some help here. I am looking for a tool that can help me find out who copied which file/folder over to our File Server. Or is there a built in option into Windows Server where I can see a text log of what has been transferred and by whom? Again your help is greatly appreciated. 

August 31st, 2015 3:37pm

You can turn on Auditing on your file server.  Here is a blog that provides a good bit of detail about how to do this - http://blogs.technet.com/b/mspfe/archive/2013/08/27/auditing-file-access-on-file-servers.aspx.

Free Windows Admin Tool Kit Click here and download it now
August 31st, 2015 5:07pm

You might need to enable Object Access: File System Audit Policy setting.
 
Monitor the Event 4663 (An attempt was made to access an object), which will allows you to track what content was accessed, the source (IP address and port) of the request, and the user account used for the access. However, this might not be able to accurately reflect the copy activity, only about file/folder creation, data write.
 
Also, please note that audit events are only generated for objects that have configured system access control lists (SACLs). So after configuring the Audit Policy setting, you will have to enable it in the Access Control List of the resource
 
(Right click and go to properties, click the security tab>Advanced>Auditing Tab>Edit>Add>then add the group that has access to that folder>Select the events you want to audit and click OK).
 

Regards,

Eth

September 1st, 2015 2:41am

1. apply GPO to file server with following audit policy setting under Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access: File System Success
 2. In the Enable folder auditing entity by selecting full control
Roger
Free Windows Admin Tool Kit Click here and download it now
September 1st, 2015 2:56am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics