Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251
Possible to track user's file system usage?
Possible to track user's file system usage?

Possible to track user's file system usage?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Possible to track user's file system usage? -=gu=- 03-20-2006
Posted by =?Utf-8?B?LT1ndT0t?= on March 20, 2006, 11:44 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello,
We have a top level employoee who has given his 2 week notice. The president
of the company came to me becuase he is worried that this employee will
'steal' information over the next two weeks. Now likely if he were going to
do that, he already would have before putting in his notice. It is important
to the company that he trains his replacement over the next two weeks, so
they'd rather not terminate him immediatley.
So my question is, is there a way (or 3rd party product) in Windows
200003 to capture\audit what files a user copies from network drives to
his local computer?
Thanks!

Posted by =?Utf-8?B?UGFuZGFfbWFu?= on March 20, 2006, 12:57 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
My reply is at the bottom of your message :

"-=gu=-" wrote:

> Hello,
> We have a top level employoee who has given his 2 week notice. The president
> of the company came to me becuase he is worried that this employee will
> 'steal' information over the next two weeks. Now likely if he were going to
> do that, he already would have before putting in his notice. It is important
> to the company that he trains his replacement over the next two weeks, so
> they'd rather not terminate him immediatley.
> So my question is, is there a way (or 3rd party product) in Windows
> 200003 to capture\audit what files a user copies from network drives to
> his local computer?
> Thanks!


Hello ! I am not specialist for corporate networking and thing like that . I
have never heard of application that can say what software/files has been
copied *but* I do belive your request is not strictly connected to computers
and IT .
It is more like company / personal problem and I belive these should not be
passed by this way .
May be someone else will help you ! :)

Feel free to contact the Community again !

Panda_man
--
Prevention is always better than cure !
--
My web page:
http://pandaman.my.contact.bg
Learn how to protect your computer:
http://www.microsoft.com/protect
Please , rate posts

Posted by Steven L Umbach on March 20, 2006, 6:59 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
You can enable auditing of object access on his computer and then audit
write permission on directories on his computer that he has write access to
which would be at least his user profile though this is far from a user
friendly process. If you decide to do such be sure to increase the size of
the security log on his computer to at least 20MB and understand he could
bypass auditing by writing directly to removable media such as an USB drive.
My experience in management and with people is that if they are honest and
trustworthy they will be that way till the end particularly in an
environment where employees are appreciated and treated fairly along with
being held accountable. If they are not then they already got what they
want. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;300549
http://www.microsoft.com/technet/security/topics/auditingandmonitoring/securitymonitoring/default.mspx

> Hello,
> We have a top level employoee who has given his 2 week notice. The
> president
> of the company came to me becuase he is worried that this employee will
> 'steal' information over the next two weeks. Now likely if he were going
> to
> do that, he already would have before putting in his notice. It is
> important
> to the company that he trains his replacement over the next two weeks, so
> they'd rather not terminate him immediatley.
> So my question is, is there a way (or 3rd party product) in Windows
> 200003 to capture\audit what files a user copies from network drives to
> his local computer?
> Thanks!



Posted by Roger Abell [MVP] on March 21, 2006, 12:24 am
If you were  Registered and logged in, you could reply and use other advanced thread options
If you have not previously set up auditing then what has happened
has without trace. If you want to try following through lots of logs
you could set a access audit for that user only on each and every
source of concern (one audit ACE set at each root and inherited
to entire substructures). As Steve has pointed out, attempting to
audit at the workstation probably would no do much (use different
machine for example).

> Hello,
> We have a top level employoee who has given his 2 week notice. The
> president
> of the company came to me becuase he is worried that this employee will
> 'steal' information over the next two weeks. Now likely if he were going
> to
> do that, he already would have before putting in his notice. It is
> important
> to the company that he trains his replacement over the next two weeks, so
> they'd rather not terminate him immediatley.
> So my question is, is there a way (or 3rd party product) in Windows
> 200003 to capture\audit what files a user copies from network drives to
> his local computer?
> Thanks!



Posted by =?Utf-8?B?LT1ndT0t?= on March 21, 2006, 9:19 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Thank you all for your responses! I think we will just let the two weeks pass
and hope for the best. The user is in Vancouver and we are here in
Philadelphia. Thanks again!

-=gu=-

Similar ThreadsPosted
track user's operation to files or folder in windows 2003 server March 21, 2006, 12:40 am
Monitoring file usage September 20, 2005, 10:21 am
Track transfer of files from desktop system September 7, 2007, 2:42 pm
System Restore File is a PUP August 1, 2006, 2:05 am
Undeletable and Resuscitator file in system January 17, 2006, 2:34 pm
How can a graphic file get full system control? November 11, 2005, 6:34 pm
File System Security Setting Causes Slow Logon November 15, 2005, 7:21 pm
Ports usage March 29, 2006, 1:58 pm
Logging USB Drive usage October 19, 2006, 9:46 am
audit CD /DVD usage on Windows XP professional June 23, 2008, 7:23 am

The site map in XML format XML site map

Contact Us | Privacy Policy