File Server Auditing

[richbrowncardiff]

Hi All,

 

Hope i have put this in the right place! What is everyone doing regarding File server auditing ? like most we have £0 for new software solutions and the free editions of the likes of Netwrx doesn't cut it. (for us anyway)

 

I need something which monitors file access, modification, deletion etc and reports who did what where and when.

 

Any help gratefully received

[Fazza]

Never managed to find an open source program that does this as we also have a budget of £0 for this sort of thing! The full version of Netwrix is great but prohibitively expensive

[Steve21]

What about the normal Microsoft one? It's not exactly fancy, and digging stuff out can be a pain, but its free and works

 

Or did you need specific reporting for management reports etc?

 

Can always setup auto flags and alerts from Task Manager for any specific attempts to delete etc or blocked access as required, may take a bit of setting up but free and what not

 

Steve

[Fazza]

What about the normal Microsoft one? It's not exactly fancy, and digging stuff out can be a pain, but its free and works

 

Or did you need specific reporting for management reports etc?

 

Can always setup auto flags and alerts from Task Manager for any specific attempts to delete etc or blocked access as required, may take a bit of setting up but free and what not

 

Steve

 

Does it have a name this 'Microsoft one' please?

 

For us the main thing we need to see is who has deleted what files and when.

[psydii]

Try this for free:

https://michaelfirsov.wordpress.com/windows-audit-part-4-tracing-file-deletions-in-ms-powershell/

[Steve21]

It's literally called File Auditing (Or File Access Auditing one of the two) Will try to find the guide I used as haven't done it in a while (once it's setup it just runs)

 

Once file auditing is turned on (via GPO etc), you can modify what it tracks e.g. Read/Deletes etc and then it logs it to event viewer under auditing. (With a bit of powershell or task manager you can get it to email you when it flags etc, or just have it log until you need to view it)

 

Basic, and not exactly shiny with graphs etc, but easy way to log deletes (or attempted access)

 

Steve

[Fazza]

It's literally called File Auditing (Or File Access Auditing one of the two) Will try to find the guide I used as haven't done it in a while (once it's setup it just runs)

 

Once file auditing is turned on (via GPO etc), you can modify what it tracks e.g. Read/Deletes etc and then it logs it to event viewer under auditing. (With a bit of powershell or task manager you can get it to email you when it flags etc, or just have it log until you need to view it)

 

Basic, and not exactly shiny with graphs etc, but easy way to log deletes (or attempted access)

 

Steve

 

I didnt think it logged file deletions so didnt bother looking at it.

[timbo343]

You mentioned there's 0 budget for it but i know ISDecisions do something called fileaudit whih i have demo'd. I wanted 1 license for our shared file server but it got rejected, i think it was about £350 but there may be a educational discount now applied. Maybe @ISDecisions_Mel could do you a price.

[free780]

I found the sheer amount of events means I had to forward the events to MS SQL. Then I needed some queries.