Sign in with
Sign up | Sign in
Your question

Knowing what the user did with a file?

Tags:
  • Security
  • Microsoft
  • Windows XP
Last response: in Windows XP
Share
Anonymous
a b 8 Security
August 1, 2005 7:15:32 PM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Hello. I want to know how can i audit or know if an user changed,
copied, deleted or created a file.

I am looking for this because i recently had a problem with a notebook
user that stole information from the company. I tried with the audit
policies of Windows XP but it doesn´t give me what i need.

Any idea?

Thanks.


--
gerteix

More about : knowing user file

August 1, 2005 7:15:33 PM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

gerteix wrote:

>
> Hello. I want to know how can i audit or know if an user changed,
> copied, deleted or created a file.
>
> I am looking for this because i recently had a problem with a notebook
> user that stole information from the company. I tried with the audit
> policies of Windows XP but it doesn´t give me what i need.
>
> Any idea?
>
> Thanks.
>
>
You would have needed to enable auditing *before* the incident. For
serious issues like yours, you should contact a professional company
which specializes in computer forensics. If the case is not handled
correctly, any information gathered will not hold up in court. I can
recommend DriveSavers, but there may be an expert in your area of the
world. You'll have to look.

http://www.drivesavers.com/services/forensics.html

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User
Related resources
!