See if a folder/file has been copied

[dotobi]

Hi

Is there a way to see if a user has copied a folder or group of files to an external source, such as an external hard drive? Maybe though event logs or whatever?

Thanks

 

[maxthedork]

Only if you have auditing turned on. Obviously turning on Auditing won't do anything for you after the fact, but you can audit file copy operations. You do this through perfmon, Performance Logs and Alerts.

 

[bcastner]

No such animal in perfmon or otherwise. A lot of people are unhappy with object access auditing on Windows, because what they want to know is "who touched the object and what did that person do", but what Windows auditing tells you is actually "who touched the object and what did they ask for permission to do". The distinction is subtle, but if you are interpreting object access events as recording what changes were made to objects, including copying, then you're probably misunderstanding what the log is saying.