Knowing what the user did with a file?

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Hello. I want to know how can i audit or know if an user changed,
copied, deleted or created a file.

I am looking for this because i recently had a problem with a notebook
user that stole information from the company. I tried with the audit
policies of Windows XP but it doesn´t give me what i need.

Any idea?

Thanks.


--
gerteix
1 answer Last reply
More about knowing user file
  1. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    gerteix wrote:

    >
    > Hello. I want to know how can i audit or know if an user changed,
    > copied, deleted or created a file.
    >
    > I am looking for this because i recently had a problem with a notebook
    > user that stole information from the company. I tried with the audit
    > policies of Windows XP but it doesn´t give me what i need.
    >
    > Any idea?
    >
    > Thanks.
    >
    >
    You would have needed to enable auditing *before* the incident. For
    serious issues like yours, you should contact a professional company
    which specializes in computer forensics. If the case is not handled
    correctly, any information gathered will not hold up in court. I can
    recommend DriveSavers, but there may be an expert in your area of the
    world. You'll have to look.

    http://www.drivesavers.com/services/forensics.html

    Malke
    --
    Elephant Boy Computers
    www.elephantboycomputers.com
    "Don't Panic!"
    MS-MVP Windows - Shell/User
Ask a new question

Read More

Security Microsoft Windows XP