Audit trail or log when accessing a file

I have a client with 8 Win XP PCs on a small peer network (a workgroup, not
a domain). One PC is a file server which holds the business-related files
that everybody in the office is allowed to access (read-only).

Yesterday, one of his employees quit and the client is wondering if that
employee viewed (and maybe copied) any of the files containing customer
lists. Even though everybody has permission to view the files, the client
wants to know if there's any way to know _which_ employees accessed _which_
files and _when_.

I'm not aware of any Win XP audit trail or log that would track
cross-network file access like this, at least nothing that's currently
within XP that we could query for accesses in the past. Assuming there
isn't, anyone familiar with such a tool for future use?

p.s. NTFS has a "last-accessed" date field, but it doesn't have who/when
data and it doesn't have history.


-- Gary Richtmeyer, Tampa, FL

"Gary Richtmeyer" wrote
>I have a client with 8 Win XP PCs on a small peer network (a workgroup, not
>a domain). One PC is a file server which holds the business-related files
>that everybody in the office is allowed to access (read-only).
>
> Yesterday, one of his employees quit and the client is wondering if that
> employee viewed (and maybe copied) any of the files containing customer
> lists. Even though everybody has permission to view the files, the client
> wants to know if there's any way to know _which_ employees accessed
> _which_ files and _when_.
>
> I'm not aware of any Win XP audit trail or log that would track
> cross-network file access like this, at least nothing that's currently
> within XP that we could query for accesses in the past. Assuming there
> isn't, anyone familiar with such a tool for future use?
>
> p.s. NTFS has a "last-accessed" date field, but it doesn't have who/when
> data and it doesn't have history.

There is auditing in XP Pro. It has to be turned on. See this article
How to audit user access of files, folders, and printers in Windows XP
http://support.microsoft.com/kb/310399

--
Rock [MS-MVP User/Shell]

"Rock" <Rock@nospam.net> wrote in message
news:%237AW4gApHHA.4772@TK2MSFTNGP05.phx.gbl...
> "Gary Richtmeyer" wrote
>>I have a client with 8 Win XP PCs on a small peer network (a workgroup,
>>not a domain). One PC is a file server which holds the business-related
>>files that everybody in the office is allowed to access (read-only).
>>
>> Yesterday, one of his employees quit and the client is wondering if that
>> employee viewed (and maybe copied) any of the files containing customer
>> lists. Even though everybody has permission to view the files, the client
>> wants to know if there's any way to know _which_ employees accessed
>> _which_ files and _when_.
>>
>> I'm not aware of any Win XP audit trail or log that would track
>> cross-network file access like this, at least nothing that's currently
>> within XP that we could query for accesses in the past. Assuming there
>> isn't, anyone familiar with such a tool for future use?
>>
>> p.s. NTFS has a "last-accessed" date field, but it doesn't have who/when
>> data and it doesn't have history.
>
> There is auditing in XP Pro. It has to be turned on. See this article
> How to audit user access of files, folders, and printers in Windows XP
> http://support.microsoft.com/kb/310399
>
> --
> Rock [MS-MVP User/Shell]

Thanks Rock,

I've briefly tested it on my office server and it appears that it will do
what I need. I got a LOT of events, but I'm guessing I can pare down the
auditing (I only want accesses of *files* within a folder).

-- Gary

"Gary Richtmeyer" wrote
> Thanks Rock,
>
> I've briefly tested it on my office server and it appears that it will do
> what I need. I got a LOT of events, but I'm guessing I can pare down the
> auditing (I only want accesses of *files* within a folder).

You're welcome, Gary, glad it works for you.

--
Rock [MS-MVP User/Shell]