Audit when a user copies a file

Hello,

can I audit when an user copies a file from the fileserver? I'm using
Windows 2003.

Thanks!
JD

S
Thu Sep 18 01:57:33 PDT 2008

G'day:

Gatsu wrote:
> Hello,
>
> can I audit when an user copies a file from the fileserver? I'm using
> Windows 2003.
>
> Thanks!
> JD

Enable audite for success reading the file(s).

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

Gatsu
Fri Sep 19 01:03:36 PDT 2008

On 18 Set, 10:57, "S. Pidgorny <MVP>" <slavi...@yahoo.com> wrote:
> G'day:
>
> Gatsu wrote:
> > Hello,
>
> > can I audit when an user copies a file from the fileserver? I'm using
> > Windows 2003.
>
> > Thanks!
> > JD
>
> Enable audite for success reading the file(s).
>
> --
> Svyatoslav Pidgorny, MS MVP - Security, MCSE
> -= F1 is the key =-
>
> *http://sl.mvps.org*http://msmvps.com/blogs/sp*

Thanks so much dear Svyatoslav, but with this option "Enable audit for
success reading the file(s)" can I distinguish when an user read or
copies a file?

JD

S
Fri Sep 19 01:40:14 PDT 2008

G'day:

Gatsu wrote:

> Thanks so much dear Svyatoslav, but with this option "Enable audit for
> success reading the file(s)" can I distinguish when an user read or
> copies a file?

No. There is no way to reliably tell that information from the open file
is not copied - consider clipboard copy, for example.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *