File Copy Logs

Question

_{Monday, August 31, 2015 7:30 PM}

Hello everyone,

I'm hoping I can find some help here. I am looking for a tool that can help me find out who copied which file/folder over to our File Server. Or is there a built in option into Windows Server where I can see a text log of what has been transferred and by whom? Again your help is greatly appreciated. 

All replies (4)

_{Monday, August 31, 2015 9:00 PM ✅Answered}

You can turn on Auditing on your file server.  Here is a blog that provides a good bit of detail about how to do this - http://blogs.technet.com/b/mspfe/archive/2013/08/27/auditing-file-access-on-file-servers.aspx.

. : | : . : | : . tim

_{Tuesday, September 1, 2015 6:34 AM ✅Answered}

You might need to enable Object Access: File System Audit Policy setting.
 
Monitor the Event 4663 (An attempt was made to access an object), which will allows you to track what content was accessed, the source (IP address and port) of the request, and the user account used for the access. However, this might not be able to accurately reflect the copy activity, only about file/folder creation, data write.
 
Also, please note that audit events are only generated for objects that have configured system access control lists (SACLs). So after configuring the Audit Policy setting, you will have to enable it in the Access Control List of the resource
 
(Right click and go to properties, click the security tab>Advanced>Auditing Tab>Edit>Add>then add the group that has access to that folder>Select the events you want to audit and click OK).
 

Regards,

Ethan Hua

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

_{Tuesday, September 1, 2015 6:49 AM}

1. apply GPO to file server with following audit policy setting under Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access: File System Success
 2. In the Enable folder auditing entity by selecting full control
Roger

_{Wednesday, September 2, 2015 10:17 AM}

As said above, you need to enable auditing on file server that will let you track every changes and obtain the information in-depth. To enable auditing on file server, you can follow the steps given into this informative PDF guide that covers all the required aspects with detail information : http://www.lepide.com/guide/enable-file-folder-access-auditing.pdf

Carlo