Re: Auditing moved/copied files on a Win2003 network

[Jørgen Hovelsen <jorgen.hovelsen () ntnu no>]

Scott Race wrote:
> We have a situation where an employee is leaving and some files got
> moved on our server.  Nothing was deleted, but we're trying to figure
> out if he copied them to a CD, USB flash drive, etc.  I could not find
> where Windows 2003 Server will let you audit file copies and moves, just
> deletes and accesses.  Is there something I'm missing that's built in,
> or what 3rd party applications are available (smaller budget, office of
> 15 users)?

Windows can audit "objects" (files, folders..). This type of auditing is 
default turned off.

You can read this to learn more about it: 
http://technet2.microsoft.com/windowsserver/en/library/50fdb7bc-7dae-4dcd-8591-382aeff2ea791033.mspx?mfr=true

You can also google "audit files folders windows 2003".

I have used MOM 2005 (SCOM 2007 might be a better choice now) and find 
it very useful, but it might be overkill for a small budget.

--
Jørgen Hovelsen