Archived from groups: microsoft.public.windowsxp.security_admin (More info?)
> Hello. I want to know how can i audit or know if an user changed,
> copied, deleted or created a file.
> I am looking for this because i recently had a problem with a notebook
> user that stole information from the company. I tried with the audit
> policies of Windows XP but it doesn´t give me what i need.
> Any idea?
You would have needed to enable auditing *before* the incident. For
serious issues like yours, you should contact a professional company
which specializes in computer forensics. If the case is not handled
correctly, any information gathered will not hold up in court. I can
recommend DriveSavers, but there may be an expert in your area of the
world. You'll have to look.