Interface Posted May 3, 2006 Share Posted May 3, 2006 Hi, I would like to log the actions done by the users on a network share folder like, COPY, DELETE,MODIFY of files in it.Not to Monitor the Action But I need to Log this into a .txt file. Link to comment Share on other sites More sharing options...
cluberti Posted May 4, 2006 Share Posted May 4, 2006 I'm sure there are third party utilities that can do this, but you can also enable auditing in Group Policy to do this as well, logging into the event log. Link to comment Share on other sites More sharing options...
Interface Posted May 8, 2006 Author Share Posted May 8, 2006 Hi,I have tried many of this with GPO Auditing, and also on a shared folder in on the security tab but I didn't get the information like which file is created, or which file is copied etc... Besides the security log will in increase very fast and its headache... Security log will not give a correct information to point some users... for forensic!!!!!I have used this script to notify the actions but I need to log this information in a text file or invoke email some this like that ….Do any body now any third party tool? Or any body can help on this script '********************************************' This will aletr the activities in the folder c:\Force' Written By Belive The Force....'*********************************************strComputer = "."Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")Set colMonitoredEvents = objWMIService.ExecNotificationQuery _ ("SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE " _ & "Targetinstance ISA 'CIM_DirectoryContainsFile' AND " _ & "TargetInstance.GroupComponent= " _ & "'Win32_Directory.Name=""c:\\\\force""'")Set colMonitoredEvents = objWMIService.ExecNotificationQuery _("SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE " _ & "Targetinstance ISA 'CIM_DirectoryContainsFile' AND " _ & "TargetInstance.GroupComponent= " _ & "'Win32_Directory.Name=""c:\\\\force""'")Do Set objLatestEvent = colMonitoredEvents.NextEvent Wscript.Echo objLatestEvent.TargetInstance.PartComponentLoopAny changes or idea to meet the requirement will be appreciable .... Link to comment Share on other sites More sharing options...
cluberti Posted May 8, 2006 Share Posted May 8, 2006 The only Microsoft tool that I'm aware of that does this is the File System Resource Manager in Windows 2003 R2 - otherwise, you're stuck with (limited) auditing via a GPO. There are probably 3rd party utilities that can do this, but I do not have any I know of and thus none that I can recommend. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now