Auditing file share access

[googlemad]

I'm trying to exterminate a 2003 server but need to find out who (if anyone) is still accessing any of the standard shared folders held on it! Is there an easy way of doing things other than messing about with Windows auditing which I've always found a bit rubbish anyway?

 

Just need to know if someone opens either a share or a file inside a share, their computer name / username (both ideally but either or is fine!). It is part of AD if that helps

[Sagima]

I think I'd just turn it off for a month and see who complains (well I'd probably just rename it so they couldn't access it and then transfer stuff once they called in about it.)

 

Would | Computer Management > System Tools > Shared Folders > Open Files | have the info you need although that's a bit manual

 

 

(sorry it's been 7-8 years since I used 2003)

[penfold]

When we did this we followed the same process as @Sagima. I just looked during the day to see if anyone was accessing anything and then turned the shares off before doing the same with the server.

[manc_techie]

I've used a 30 day trial of ISDecisions FileAudit to find who accesses what on shares before locking them down. You can keep the reports for reference at a later date