Hello, I have file sharing server, someone created a file, I need to trace from which IP that was created, is there anyway to find this thing? Also is there any software which works like that ? Please let me know I really need help. Thanks in advance. Regards, Sohaib Khan Hello, Sorry but AFAIK Microsoft solutions does not provide such tracking ability. Here you have to use another third party softwares. Maybe other contributors here know a good one. You can enable auditing of files and folder changes via group policies under Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Audit Policy and configure Audit object access setting. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

Hi Liran, Thank you... I applied the policy as instructed on that link. Now, how will i trace? I mean i tested on my PC, i applied that policy on my D: drive and then share a folder in it, and make changes via sharing. Now how will i check from which IP i access that folder and create a file? Many thanks Sohaib Khan

You need to check the security logs. Check this article. http://msmvps.com/blogs/richardwu/archive/2010/07/16/enabling-file-and-folder-auditing.aspx Other utilities can also be found on the internet. 1. 10-Strike Connection Monitor 2.1 2. NetWrix File Server Change Reporter Thanks

Hello, I have file sharing server, someone created a file, I need to trace from which IP that was created, is there anyway to find this thing? Also is there any software which works like that ? Please let me know I really need help. Thanks in advance. Regards, Sohaib Khan

Hello, You cannot trace to find the IP of the machine that created the file. For future you can enable NTFS auditing - http://networkadminkb.com/KB/a68/recommended-ntfs-audit-policy.aspx Please let me know if you need another help. Thanks, Liran.

I recommend you Scriptlogic solution http://www.scriptlogic.com/products/filesystemauditor/comparisonmatrix.asp Regards Milos