Member Avatar for handy7390

I am getting ready to implement a new Server 2003 (with upgrade to 2007/08) and want to have the Server or some software monitor odd activity. Such as an employee copying an entire jobs directory (3GB directory and contains everything about any particular job). This would hint to working on the side or getting ready to leave and work for a competitor. Is there software that would red flag and attempt to copy an entire directory or files/folders I specify as "NOT OK" to copy all. We are a small 15-20 employee company. I would Google this topic, but I have no idea what syntax to Google.

  • 2 Contributors
  • 3 Replies
  • 97 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by DimaYasny

Dani AI

Generated

Short, practical plan for (and thanks to for pointing toward auditing). For a small shop wanting to spot a bulk copy of a 3GB jobs folder, the reliable approach is targeted server-side auditing plus simple alerting or a light DLP layer. Broad read-auditing across an entire drive will fill logs and cause noise; focus only on the sensitive folder(s).

Steps to implement (minimal disruption):

  • Identify the exact folder(s) to protect and who legitimately needs access.
  • Turn on object-access auditing in the domain or local security policy, then add an auditing (SACL) entry on the job folder to record successful "read/open" and delete events for the relevant groups. Test on one account by copying a small test folder and confirm events appear in the Security log.
  • Increase Security log size and enable log archiving or forward events to a collector/SIEM so alerts are not lost when logs wrap. Use a simple alert rule that flags one account generating an unusual burst of file-access events in a short window (for example, many file opens under the job folder within 5-10 minutes).
  • For network copies, correlate server-side file-access events with network flow or firewall logs to spot transfers of large total bytes from a single machine or account.

Additional controls and cautions:

  • Preventive controls (best practice): tighten NTFS permissions, remove unnecessary admin rights, and block removable media with Group Policy if exfiltration via USB is a concern.
  • Expect large event volumes; do not audit everything. Audit only what is necessary and tune alerts to reduce false positives.
  • Employee monitoring can have legal and privacy implications; coordinate with HR/legal before rolling out broad monitoring.

For authoritative guidance on file-system auditing and File Server Resource Manager (useful for reporting/quota work), see Microsoft's docs on auditing and FSRM:

Recommended Answers

All 3 Replies

Member Avatar for DimaYasny

look for file access audit.

Member Avatar for handy7390

Thank you. This looks like what I am looking for.

Member Avatar for DimaYasny

have fun :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.