Re: Looking for the softwares to monitor our file server

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

On 2006-09-25 Truong duc Luong wrote:
> I'm a network manager at smal-size company. We've one file server
> using Windows 2003 server. I'm only using Event Viewer to log all
> operation with the file server. Recently, some important data in the
> file server have been deleted.  So, I can't detect when does this
> operation occurs? And Who do this?

Of course you can. Just add a new SACL for logging successful delete
operations (probably failed operations as well) to the folder(s) in
question.

Regards
Ansgar Wiechers
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------