View original (French)

Track the history of a folder copied on my network

Solved
kaenef_irt Posted messages 124 Status Member -  
kaenef_irt Posted messages 124 Status Member -
Hello,

I am the network administrator of my company (network 15 users - a Dell PE T110 server running Windows Server 2003 R2), and when I configured my server, I left a public directory accessible to all users. However, there is currently a folder in this directory containing sexually explicit videos, and I would like to know from which machine on the network this folder was copied.

How can I proceed?

Configuration: Windows Server 2003 R2

2 answers

  1.
    kelux Posted messages 3065 Registration date   Status Contributor Last intervention   434
     
    Hi,

    You can "maybe" find the file owner through the advanced properties of the file (from the security tab).

    Otherwise, you need to enable file auditing on the server to track access ...

    However, be careful as it can become very verbose, and the logs can fill up very quickly. The issue is that by default, we won't be able to keep records for a long period.
    For that, you need to plan for log rotation or log dumps, and the storage space dedicated for archiving these logs.

    So without Audit = no traces, even if you enable it later, you won't see what was done before ...

    --

    Luc L.
    [Gentoo Is Good]
    0
  2. kaenef_irt Posted messages 124 Status Member 2
     
    Thank you Kelux, I finally found it. I just had to make the "owner" tab appear in the relevant directory. At that point, I was able to identify the machine from which the subscription was made.

    Thanks again!
    0