How to track usage on a Window 2003 file server

[Samson]

I hope this is a suitable question to ask here. Feel free to point me at more suitable forums if you know of any. I have had such good luck on CFC over the years I thought I would try.

I have a friend whose company suspects 2 of their employees of planning to set up their own competitor of the company. If they were accessing large amounts of data from the Window 2003 file share this would be good to know, and if we knew which files that would be even better. He asked me how they could find this out. As I have no experience with windows, I said set up wireshark and look at the activity of their ip addresses. This would not be easy, and I suspect there is a way of doing this on the server. Can anyone give us some pointers?

 

[Till]

Windows 2003 server has auditing functionality. Fire up the Local Security Policy, and there should be something about Audit Policy Configuration. If you select Object Access, you can enable access logs for all sorts of stuff, including folders. Here is a guide

Of course this only works if they access the shares through an non public account. If they don't, Wireshark is a good idea. It also works on windows.

 

[Samson]

Thank you very much, that looks like exactly what he needs to do.

[EDIT] Man I love CFC. Advice on city placement mechanics, discusion of geopolitics and pretty darn advanced IT support all in one place. Where else does the geek need go