Auditing File Copy

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I would like to Audit file copy in the System area of the Event Viewer in
WindowsXP. I have turned on auditing and set up the folders I want to audit.
However there is no separate copy audit type and I see thousands of Reads
being audited. Is there any way to audit just file copies? If not natively
in XP then does anyone know of a 3rd party tool to achieve this.

Any help would be great.

Cheers

Colin

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399&Product=winxp

R-Guard Data Security Software
http://www.data-security-softw­are.com/

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Get Windows XP Service Pack 2 with Advanced Security Technologies:
http://www.microsoft.com/athome/security/protect/windowsxp/choose.mspx

-------------------------------------------------------------------------------------------

"Colin J Paterson" wrote:

| I would like to Audit file copy in the System area of the Event Viewer in
| WindowsXP. I have turned on auditing and set up the folders I want to audit.
| However there is no separate copy audit type and I see thousands of Reads
| being audited. Is there any way to audit just file copies? If not natively
| in XP then does anyone know of a 3rd party tool to achieve this.
|
| Any help would be great.
|
| Cheers
|
| Colin

 

[Dave]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

how would you know if the file is being copied or just being read for any
other reason? for instance, the low level file access is exactly the same
when you open a file and display it in notepad as when you copy it byte by
byte so some other file. so how could any audit software know for sure what
the disposition of bytes being read from a file was?

"Colin J Paterson" <nospam@thanks.com> wrote in message
news:uXMfAxkKFHA.3896@TK2MSFTNGP10.phx.gbl...
> I would like to Audit file copy in the System area of the Event Viewer in
> WindowsXP. I have turned on auditing and set up the folders I want to
audit.
> However there is no separate copy audit type and I see thousands of Reads
> being audited. Is there any way to audit just file copies? If not natively
> in XP then does anyone know of a 3rd party tool to achieve this.
>
> Any help would be great.
>
> Cheers
>
> Colin
>
>

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Neither of these do what I asked.

"Carey Frisch [MVP]" <cnfrisch@nospamgmail.com> wrote in message
news:uFnLFAlKFHA.2764@tk2msftngp13.phx.gbl...
> HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
> http://support.microsoft.com/default.aspx?scid=kb;en-us;310399&Product=winxp
>
> R-Guard Data Security Software
> http://www.data-security-softw­are.com/
>
> --
> Carey Frisch
> Microsoft MVP
> Windows XP - Shell/User
> Microsoft Newsgroups
>
> Get Windows XP Service Pack 2 with Advanced Security Technologies:
> http://www.microsoft.com/athome/security/protect/windowsxp/choose.mspx
>
> -------------------------------------------------------------------------------------------
>
> "Colin J Paterson" wrote:
>
> | I would like to Audit file copy in the System area of the Event Viewer
> in
> | WindowsXP. I have turned on auditing and set up the folders I want to
> audit.
> | However there is no separate copy audit type and I see thousands of
> Reads
> | being audited. Is there any way to audit just file copies? If not
> natively
> | in XP then does anyone know of a 3rd party tool to achieve this.
> |
> | Any help would be great.
> |
> | Cheers
> |
> | Colin
>