file "tampering" suspected

[[OUPA]MrNutz]

Hi peeps

I'm looking to help a customer:

he wants a utility/function/ability to monitor files on a specific pc - by whom it is accessed , who copies to/from it...and when files were opened...

They are in a active directory environment.

 

[MadMailMan]

What OS is the client PC running? If it's XP or Vista then just configure auditing on the necessary files.

 

[[OUPA]MrNutz]

2000 pro

its in active directory environment.

i'll check the file auditing...

 

[The_Unbeliever]

2000 pro

its in active directory environment.

i'll check the file auditing...

Play around with it and see if that will help.

Also - people are sometimes under the mistaken impression that the AD server can keep track of all files accessed on the network - this is not correct as only the file server is able to keep track of the files served on itself and not on another PC. Although the AD server is able to log user logon/logoffs as well.

 

[MadMailMan]

2000 pro

its in active directory environment.

i'll check the file auditing...

The file auditing must be set on the client. 2000 Pro definately has auditing too, just can't remember how in-depth.

 

[quovadis]

You can use Active Directory and File Auditing on the server and enable it on the clients through the use of Group Policy - then everything will be logged.

 

[thisgeek]

Try this: http://support.microsoft.com/kb/310399