File Server Auditing - Track Copy Files

Question

_{Wednesday, November 4, 2015 9:55 AM}

Hi,

I'm not sure if this is the appropriate Forum but pls let me know

I have enable Auditing Policy and i have add auditing in the folders that want to track. All works fine but do you know someone how can understand if someone copy a file?

All replies (2)

_{Thursday, November 5, 2015 10:53 AM ✅Answered}

Please note that if you can open a file (with read it permissions) then you can save it anywhere.

That being said, copying is technically a read operation. So if the copy is written to the file system, you can find out the corresponding event log entries accordingly. Though, tracking such changes manually cannot ensure you about even a single clear entry to tell you what happened.

You can have a look on Lepide file access auditing tool that empowers you to get clear insight to know, who accessed a file (read) into real time.

Organizations who want increase their visibility as to what's happening in their IT environments but are perhaps limited on time, resources or budget. Lepide 2020 audit & change control suite provides instant access to see who, what, where and when changes are being made to Active Directory, Group Policy, SQL Servers, SharePoint, File Servers, Exchange Servers and more.

_{Thursday, November 5, 2015 7:29 AM}

Hi,

Audit could help us monitor if someone opens/changes/closes/deletes a file. However as Copy will not make any change on a file, I'm afraid that we cannot get an event for it. 

Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Support, contact [email protected].