Hi,

I would like to log the actions done by the users on a network share folder like, COPY, DELETE,MODIFY of files in it.

Not to Monitor the Action But I need to Log this into a .txt file.

I'm sure there are third party utilities that can do this, but you can also enable auditing in Group Policy to do this as well, logging into the event log.

Hi,

I have tried many of this with GPO Auditing, and also on a shared folder in on the security tab but I didn't get the information like which file is created, or which file is copied etc... Besides the security log will in increase very fast and its headache... Security log will not give a correct information to point some users... for forensic!!!!!

I have used this script to notify the actions but I need to log this information in a text file or invoke email some this like that ….

Do any body now any third party tool? Or any body can help on this script

'********************************************

' This will aletr the activities in the folder c:\Force

' Written By Belive The Force....

'*********************************************

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _

& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _

("SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE " _

& "Targetinstance ISA 'CIM_DirectoryContainsFile' AND " _

& "TargetInstance.GroupComponent= " _

& "'Win32_Directory.Name=""c:\\\\force""'")

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _

("SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE " _

& "Targetinstance ISA 'CIM_DirectoryContainsFile' AND " _

& "TargetInstance.GroupComponent= " _

& "'Win32_Directory.Name=""c:\\\\force""'")

Do

Set objLatestEvent = colMonitoredEvents.NextEvent

Wscript.Echo objLatestEvent.TargetInstance.PartComponent

Loop

Any changes or idea to meet the requirement will be appreciable ....

The only Microsoft tool that I'm aware of that does this is the File System Resource Manager in Windows 2003 R2 - otherwise, you're stuck with (limited) auditing via a GPO. There are probably 3rd party utilities that can do this, but I do not have any I know of and thus none that I can recommend.