XP: Finding who copied what, where, and at what time?

There are various users on my system. I am the administrator. Is there
a possibility to find out who copied files from a cdrom to the hard
drive, the details of the file that was copied, the destiniatioin to
which it was copied, etc...? Just wondering if there are system logs
pertaining to this....?

--deostroll

"deostroll" <deostroll@gmail.com> wrote in message
news:9d0cf7a6-7370-4e62-ae37-099ee27bf779@e53g2000hsa.googlegroups.com...
> There are various users on my system. I am the administrator. Is there
> a possibility to find out who copied files from a cdrom to the hard
> drive, the details of the file that was copied, the destiniatioin to
> which it was copied, etc...? Just wondering if there are system logs
> pertaining to this....?
>
>

There are third party applications that do this. Windows XP doesn't do it
out of the box beyond showing the account under which the copy was made as
the owner of the file.

On Apr 28, 2:35 pm, "M.I.5¾" <no....@no.where.NO_SPAM.co.uk> wrote:
> "deostroll" <deostr...@gmail.com> wrote in message
>
> news:9d0cf7a6-7370-4e62-ae37-099ee27bf779@e53g2000hsa.googlegroups.com...
>
> > There are various users on my system. I am the administrator. Is there
> > a possibility to find out who copied files from a cdrom to the hard
> > drive, the details of the file that was copied, the destiniatioin to
> > which it was copied, etc...? Just wondering if there are system logs
> > pertaining to this....?

So how do we go about builiding/developing something for windows that
does the above?
-deostroll

deostroll wrote:

> On Apr 28, 2:35 pm, "M.I.5¾" <no....@no.where.NO_SPAM.co.uk> wrote:
>
>>"deostroll" <deostr...@gmail.com> wrote in message
>>
>>news:9d0cf7a6-7370-4e62-ae37-099ee27bf779@e53g2000hsa.googlegroups.com...
>>
>>
>>>There are various users on my system. I am the administrator. Is there
>>>a possibility to find out who copied files from a cdrom to the hard
>>>drive, the details of the file that was copied, the destiniatioin to
>>>which it was copied, etc...? Just wondering if there are system logs
>>>pertaining to this....?
>
>
> So how do we go about builiding/developing something for windows that
> does the above?
> -deostroll

Have you reviewed "Auditing" in Windows Help and Support?

"deostroll" <deostroll@gmail.com> wrote in message
news:66f62932-f4a5-4f65-9827-a7b7dd19251a@k37g2000hsf.googlegroups.com...
On Apr 28, 2:35 pm, "M.I.5¾" <no....@no.where.NO_SPAM.co.uk> wrote:
> "deostroll" <deostr...@gmail.com> wrote in message
>
> news:9d0cf7a6-7370-4e62-ae37-099ee27bf779@e53g2000hsa.googlegroups.com...
>
> > There are various users on my system. I am the administrator. Is there
> > a possibility to find out who copied files from a cdrom to the hard
> > drive, the details of the file that was copied, the destiniatioin to
> > which it was copied, etc...? Just wondering if there are system logs
> > pertaining to this....?

So how do we go about builiding/developing something for windows that
does the above?

Why reinvent the wheel? There are a few products that do what you want.
One that we use here is 'Sanctuary Device Control' from SecureWave. It
restrict reading and writing on a device by device basis and logs everything
copied on and off the system.

"M.I.5¾" <no.one@no.where.NO_SPAM.co.uk> wrote in message
news:48181540_1@glkas0286.greenlnk.net...
>
> "deostroll" <deostroll@gmail.com> wrote in message
> news:66f62932-f4a5-4f65-9827-a7b7dd19251a@k37g2000hsf.googlegroups.com...
> On Apr 28, 2:35 pm, "M.I.5¾" <no....@no.where.NO_SPAM.co.uk> wrote:
>> "deostroll" <deostr...@gmail.com> wrote in message
>>
>> news:9d0cf7a6-7370-4e62-ae37-099ee27bf779@e53g2000hsa.googlegroups.com...
>>
>> > There are various users on my system. I am the administrator. Is there
>> > a possibility to find out who copied files from a cdrom to the hard
>> > drive, the details of the file that was copied, the destiniatioin to
>> > which it was copied, etc...? Just wondering if there are system logs
>> > pertaining to this....?
>
> So how do we go about builiding/developing something for windows that
> does the above?
>
> Why reinvent the wheel? There are a few products that do what you want.
> One that we use here is 'Sanctuary Device Control' from SecureWave. It
> restrict reading and writing on a device by device basis and logs
> everything copied on and off the system.
>

Since no one answered his question clearly, he wants to know how to do it.

I imagine he may be able to do what he wants using the security audit tools
in XP pro.

I know you can restrict access to removeable media, but I'm not sure about
the file loging bit.

"Onsokumaru" <onsok-sama@ninja.village.jp> wrote in message
news:4818653f$0$9740$5a62ac22@per-qv1-newsreader-01.iinet.net.au...
>
> "M.I.5¾" <no.one@no.where.NO_SPAM.co.uk> wrote in message
> news:48181540_1@glkas0286.greenlnk.net...
>>
>> "deostroll" <deostroll@gmail.com> wrote in message
>> news:66f62932-f4a5-4f65-9827-a7b7dd19251a@k37g2000hsf.googlegroups.com...
>> On Apr 28, 2:35 pm, "M.I.5¾" <no....@no.where.NO_SPAM.co.uk> wrote:
>>> "deostroll" <deostr...@gmail.com> wrote in message
>>>
>>> news:9d0cf7a6-7370-4e62-ae37-099ee27bf779@e53g2000hsa.googlegroups.com...
>>>
>>> > There are various users on my system. I am the administrator. Is there
>>> > a possibility to find out who copied files from a cdrom to the hard
>>> > drive, the details of the file that was copied, the destiniatioin to
>>> > which it was copied, etc...? Just wondering if there are system logs
>>> > pertaining to this....?
>>
>> So how do we go about builiding/developing something for windows that
>> does the above?
>>
>> Why reinvent the wheel? There are a few products that do what you want.
>> One that we use here is 'Sanctuary Device Control' from SecureWave. It
>> restrict reading and writing on a device by device basis and logs
>> everything copied on and off the system.
>>
>
> Since no one answered his question clearly, he wants to know how to do it.
>
> I imagine he may be able to do what he wants using the security audit
> tools in XP pro.
>
> I know you can restrict access to removeable media, but I'm not sure about
> the file loging bit.

Your main point stands unchallenged. Nobody has still answered his question
clearly.