File Auditing Software - Kinda urgent

[Gatt]

Does anyone know of any good software for tracking file/folder activity?

 

We have a pupil here who is always complaining that work is going "missing", despite several password resets

 

His parents are now trying to jump on this saying that someone is doing this deliberately

 

What I need is an effective way to track what files are created, modified, and deleted in his home folder, as well as the time&date, and by who.

 

I have tried Win2k3 File Auditing but this doesn't seem to do much except fill up my Event Log with Object Access events.

 

If i need to pay for it then so be it.. :!:

[Ric_]

@Gatt: To be honest there is probably only one person that can delete the files (or at least one username). Files don't go missing without a VERY good reason.

 

Have you also tried changing the little darling's username to make it more difficult for his friends to log on as him?

[localzuk]

The things to check would be who has access to that user's folder and remove access to everyone except the child and yourself.

 

That way, the only account that could be deleting work is that user themselves.

 

Also, have a look at this. I don't know if it will do what you want though.

[dhicks]

> Does anyone know of any good software for tracking file/folder activity?

 

Periodic job running (every hour, more often?) "dir c:\the\path >> log.txt"? This would at least give you the times that files were changed/deleted.

 

--

David Hicks

[pete]

We have one kid (SEN) here who deletes their own files and has computer "problems" to gain attention. I'm not saying that's the issue at your place, just FYI.

[Gatt]

I have no doubt that the pupil in question is either giving out his password, or is deleting (or claiming to do so) his own work.. but we need something to prove this either way.

 

I have got sick of telling staff/pupils that work doesn't just disappear...

 

With the pupil's parents involved I need some way to prove one way or another what is going on in his home folder

 

I will be going down a Big Brother route with him over the next few days to determine what he is upto.

[elsiegee40]

Do you take Shadow Copies? It happens twice a day here - 7am and 12 noon. Previous Versions is then quite useful for narrowing down the precise timeslots.

 

Is it possible the pupil in question is being bullied out of his password?

 

Edited in afterthought:

 

Make him change his password every time he logs on? A password given away would have to be changed by the offenders and he couldn't possibly know it unless he was told by them!

[SpuffMonkey]

Assuming you have 2003 or similar, turn on File Auditing in the Advanced Security options on the share. You'll then need to wade through the Event Log or employ something like System Change Log from Greyware - we did this after a teacher was "tidying up" everybody else's files on a shared area.

 

As stated - if your security is set up right - you will just prove that someone logged on as that child deleted them - then you need CCTV cameras too!

[cookie_monster]

We use a combination or Windows file auditing - a script that logs when and where a user loggs on and then CCTV in the IT rooms to see who was sat there at the time.

[bandgeekmafia78]

Maybe you could use some software to show when this pupil has logged onto the network?

 

In all honesty we get a load of kids complaining about lost work, although I think they sometimes say it in order to gain an extension on their homework. Call me cynical but....

 

[maniac]

In all honesty we get a load of kids complaining about lost work, although I think they sometimes say it in order to gain an extension on their homework. Call me cynical but....

 

 

Same here, and I agree it is a convenient excuse for them to use, and a hard one to dis-prove. We have shadow copies turned on here, takes a snapshot at 7:00am and 12:00pm so we can easily see when the files went missing (if they were ever there in the first place.)

 

We've even hauled one kid into our office to sit and watch while we went through all the shadow copies and the backups to try and find his supposed missing file (which we concluded was never there in the first place.)

 

Amazing how the story changed as he suddenly realised we can look back at the contents of his directory almost day by day for at least the last 12 months!

 

Mike.

[Lithium]

Amazing how the story changed as he suddenly realised we can look back at the contents of his directory almost day by day for at least the last 12 months!

 

Mike.

 

I was under the impression you were only allowed to have 64 previous versions...

 

I've had this as issues before several times.

 

We whacked up our DC's security log to hold a week or two's worth of logon/logoffs so we used that to determine if the student had logged in elsewhere in college that they've never been.

 

If the log indicates they have, change the password and that's that problem solved (unless he lied.. in which case he has fun in detention)

 

The other idea might be to utilise Logon Hours and deny him/her access to log on to computers that they don't need to log onto.

[maniac]

Not all of that is shadow copies, the first 30 days are, the rest of it is from the backupexec logs, which takes a full backup, and writes a full very detailed log every night, so we searched these for his folder, and it told us what was there on that day. We keep an end of month tape, so most stuff deleted in the last 12 months is retrieveable.

 

Mike.

[Gatt]

We tried backupexec and all it did ws error during every backup attempt

We use NTBackup and Robocopy at the moment, along with Active@ Undelete to check what has been deleted

 

NTBackup is crap and often we end up with some backup stores being corrupted (we backup to an external drive not to tape)

 

BackupExec seemed the best solution but I couldn't get it working at all, so as it ws only the trial version i binned it for now.

 

Robocopy does seem to work but is slow and takes up a lot more disk space.

 

The pupil in question claims that he had a specific folder, but we have found no trace of it, but did find a word doc with the same name.

However, he has now shown the ICT Teacher another word document with a link to this mystery folder..

 

But I am dubious as there is no evidence that this folder ever existed, Active Undelete has found no trace of this folder from september.

 

I need to check out this word document and see if this link is a new addition in an attempt to prove us wrong...

[maniac]

Backup exec can be troublesome to get working, but once it is it's very good and reliable in my experience. We get some errors on our backup every night (mainly on exchange mailboxes) but overall it works well, backing up about 500GB of data for us every night.

 

Mike.

[richard.thomas]

We use a lovely piece of software called undelete. This sits on the server that holds all the students home areas. When they delete a file it ends up in our undelete recycle bin.

If they 'accidently' delete something we can recover it in a few clicks. It also has the username that deleted the file and the time/date it was deleted.

It's a great piece of kit ideally suited for schools in my opinion.

[boomam]

We use a lovely piece of software called undelete. This sits on the server that holds all the students home areas. When they delete a file it ends up in our undelete recycle bin.

If they 'accidently' delete something we can recover it in a few clicks. It also has the username that deleted the file and the time/date it was deleted.

It's a great piece of kit ideally suited for schools in my opinion.

Just remembered we've got that here! lol.

Never used it though. .

[Guest AustenLowe]

heh, use ntfs permissions to deny delete

 

This may cause a lot of temp files to be generated (they are hidden most of the time)

[greenfieldsupport]

Get round the temp files building up by just not giving access to delete, but then giving access to "creator owner"

 

that way if the file deletes itself...

It was that students account which deletes it,

 

as not even you could delete the file unless you made it

 

also it allows the machine to delete the temp files with ease...

 

we had to do that when the stupid symantec system recovery software was deleting our students ntuser.man files :|

 

Symantec have alot to answer for.........

[Nick_Parker]

I would recommend you attach a script to that users logon that net sends you when he logs on and which computer that username is logging onto, then either go and have a look and confirm it is who it's supposed to be, or open up a VNC connection...

[m25man]

I'm a bit late to be chipping in with this one, but after re-reading the origional post and thread there is no mention of how the users Home Folders/Directory is being enforced in the origional or subsequent posts by Gatt.

 

Clearly, unless there is adequate enforcement of default save paths and/or home directories surely is it not possible this kid has simply dropped their work into an unsynchronised local folder?

 

We all appear to have assumed that the kid is at fault, possibly deliberately deleting work, whereas maybe due to a security deficiency it's just been discarded/dropped elsewhere.

 

Maybe a sweep of the machines that the user has been logged into might reveal something. Drag and Drop file loss is something we see all the time in Small Businesses where folder security and group policies are not as strictly enforced as many school systems.