My accounting manager placed a spreadsheet on a server. She would like to know who is reading it. She is convinced that nobody is going to read it and wants to have proof. That way, she won't have to do the report anymore.

How do I enable auditing on this and generate a report of who has opened this file? I naturally thought that this would be very easy. It has not proven so.

I tried Filemon as well as some other utilities. They did not work.

I have enabled auditing in "Local Security Policy." This is shown as the "Effective Permission."

I have Windows 2000 server with all the updates. File is read-only for most users. The accountant has full access.

Anyway, I have enabled auditing in the Advanced part of Security. Where do the reports show up?

When I access the file myself, where do the events show up? How do I make so we can know who is reading this file?
 

She can password protect the file and only give it to you, that would be the easiest fix.

you can see it in eventviewer-security tab of the server

M. Knorr

MCSE, MCTS, MCSA, CCNA

>Where do the reports show up?

They turn up as events in the Security Event Log. Unfortunately the event log itself doesn't have the ability to filter events for specific files or folders. So you might want to get hold of one of the various event log reporting tools (several of which are free).

Alternatively, if you have any expertise in VBA, you could look at perhaps getting the spreadsheet itself to log access by adding some code to the Workbook_Open event ... this illustrates the basic idea:
 

 

delete the file and count how many people complain


"where is that darn file?"

Well, I'm not seeing file access in Event Viewer in the Security Tab. I have enabled auditing on the file. The events are not showing up. I am testing it by opening the file myself. Event Viewer makes no record that I have accessed this file.

Do these "various event log reporting tools" have names, strongm? Are they on web sites?
 

>The events are not showing up
Er ... you also have to activate auditing in the security policy applicable to the server. Googling "windows 2000 enable auditing" might have found you this. which explains the whole process: http://support.microsoft.com/kb/300549

>Do these "various event log reporting tools" have names, strongm? Are they on web sites?

Well there are several, and I don't know which would be most suitable for you. Googling for "windows event log auditing free" might have shown you: http://www.google.co.uk/search?sourceid=navclient&hl=en-GB&ie=UTF-8&rlz=1T4ADBF_en-GBGB260GB260&q=windows+event+log+auditing+free
You should be able to find something there

Strongm,

I have read that knowledgebase article on Technet. I have followed the instructions. Auditing is still not working. And, yes, I did reboot the servers after enabling auditing.
 

You don't need to reboot the server

So you have enabled auditing on the file itself via file properties?

And set the Local Security Policy appropriately by ticking Success (and Fail) for the Audit Object Access policy? The reason I ask is becasue in your first post you give the impression that you seem to think that setting the audit properties on the file is the "Local Security Policy". Which it isn't.

If you've done both of thewse things you should be seeing the relevant events in your logs.  

Yes, the Local Security Policy "Audit Object Access" is set to "Success, Failure." The Local Setting and Effective Setting both indicate "Success, Failure." I also set this on the domain controller.

Nothing shows up in Event Viewer. Do I have to enable auditing on the entire drive? Is that what it takes to get this to work?

Ok - and on the file itself you have activated auditing?

Properties/Security/Advanced/Auditing

then you have added the users whose access you want to audit (presumably Authenticated Users in this case), and ticked Successful and Failed for the List Folder/Read Data auditing entry?

Yes, I have activated auditing on the file. Yes, I have went into Properties. Yes, I have clicked Security. Yes, I have clicked Advanced. Yes, I have went to the Auditing menu. I also stated that I have done all this in my first post.

I added "Everyone" for auditing. That is what one site told me to add. I clicked on all the boxes, successes and failures.

If you know of a solution to the problem, I am happy to listen.

And if you know of an actual program that would do file auditing, that's great. You refused to answer that question.

While auditing is the ideal path to go (albeit in need of some troubleshooting in this instance), strongm did also offer a second option.

Some VBA scripting would allow you to perform the logging with ease.

"We can categorically state that we have not released man-eating badgers into the area" - Major Mike Shearer

I don't know Visual Basic. If I did know it, I would do that.

Suffice it to say that if, as you say, you have correctly enabled those settings as per either the technical posts or my double-checking, I can't think of a reason why it isn't working and thus cannot help you. Those settings have worked solidly and reliably for me on vast numbers of machines for about 15 years.
 

It certainly would have saved us both a lot of time if you had simply admitted that you didn't have a solution. It seems like you just wanted to prove that I had done it wrong.

This whole exchange is just a sad reminder of how worthless discussion groups like these have become.

dberg 35--your answer was worthless.

North323--your answer was worthless.

 

I'm beginning to understand why you have so many issues with your users.

may have been worthless but was funny.  its users like you that come in here demanding answers and get upset when we dont offer a solution.  maybe you should do some leg work and find the answer.  we do the best we can with what we have.  we are all trying to help each other out.
so my answer was not worthless and dberg's answer was not worthless.  and sorry if strongm even tried to help you.  i dont think it was his intention to prove you wrong.  if you think these discussion groups are worthless...open a ticket with microsoft for your windows 2000 box (if you can get support for that)