How can I tell who created/modified a file on a shared drive? 1

[skhoury]

Hello all - is it possible in Windows2K3 to tell who created or modified a file under a share?

any thoughts are appreciated,

Thanks all,

Sam

 

[WhoKilledKenny]

You can tell who created the file by looking at the owner property. You would have to set up auditing on the file to capture who modifies or deletes it.

 

[skhoury]

Very interesting - how do I setup auditing?

 

[WhoKilledKenny]

From the file server. Choose the Folder(s) or File(s) you wish to audit, right-click - properties. Choose the Security Tab and click on the Advanced button -> Auditing Tab.

There is a link on the sheet called "Learn more about auditing." Click on the link which will help you set it up. Here is just a snipit:

"Establishing audit policy is an important facet of security. Monitoring the creation or modification of objects gives you a way to track potential security problems, helps to ensure user accountability, and provides evidence in the event of a security breach.

 

[skhoury]

Perfect, thanks a million!