Technical Networking question!

Ace Modder

Ace Modder

Ace Modder

Soldato
Joined
8 Sep 2003
Posts
23,180
Location
Was 150 yds from OCUK - now 0.5 mile; they moved
Hey guys.

I have given my neighbour access to a collection of files on my PC via my router. I have setup a guest access account using a secondary SSID which is encrpyted. I have given him read access to 2 folders on my network. A bunch of video files.

Anyway, is there any way for me to check which files he has accessed/copied over to his own PC?

Using a WNDR3700 router :)
 
I know in computer managerment you can view live sessions (well F5 updates the screen anyway), but I want to record it in a log, any ideas?
 
Audit file and folder access
You can enable folder auditing on the shared folders and configure for what you need

I think that's what your looking for, need more info just post, it might take me some time to write up a walk through but that's what are forums for.
Thinking about it it would be more auditing object access
 
Last edited:
1. Press Windows Key + R, type gpedit.msc and press enter.

This command opens the Local Computer Policy. In the left pane you will see:

85390546.png


2. In the left pane expands Computer Configuration, Windows Settings, Security Settings an go to Audit Policy.

This is what you will see:

67776056.png


3. Double click over Audit object Access:

16498228.png


4. Select Success, you can select failure too but in this case we only want to know if someone access a file.

32319004.png


5. Press Ok.

6. Go to the file you want to audit. In our case a file named file.txt at c:\utils. Right click and select properties.

7. Go to Security Tab:
17216034.png


9. You need know to add the users you want to audit the access to the file. If you want all select everybody.

8. Press Advanced, go to auditing tab, and press continue:
17888499.png


10. You will see a list of checking boxes in our case we select:
37211228.png


11. Press Ok in every window opens.

12. Open a close the file to create an event in the event viewer. Event viewer use the created events to setup the filter so you will need at least one.

13. Open Event Viewer. Press Windows Key +R. Type:

%windir%\system32\eventvwr.msc /s

press intro.

14. Press Create Custom View in the right pane:
63229246.png


15. Select Filter by log, and Security:
22588027.png


16. In event sources look for Microsoft Windows security auditing.
52076530.png


At the end you will see something like this:
36602988.png


17. On Task category select File System:
91464952.png



18. Select Audit Access on keywords:

73622515.png


19. Select a name for the filter and press ok on every window that opens.

Source: discoveryourpc
 
Last edited:
Firstly kudos to redshadows on the walkthrough, very good (inc cropped screenshots) and must have taken a fair amount of time

Anyway OP, have you considered using FTP instead e.g. Filezilla server? Back in the day at uni we used to use normal fileshares but most big sharers moved to FTP to make things manageable. FTP servers include logging of all activity, but will also allow you control over bandwidth and concurrent access, to ensure that the disk/wifi don't get thrashed. As a potential side benefit, FTP also prevents streaming so might let your disks have more idle time (e.g. 10min to copy movie vs 2hr streaming to watch it). It's pretty easy to setup.
 
There's no gpedit in Home Premium. You need the domain aware versions installed (Biz/Ultimate) OR the files available in those versions.

Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.
Click to expand...
 
Dang, I never even thought of gpedit not being in another version on win 7.

Its still server 2005 I am using work wise, I only know gpedit from playing about at home and I have only ever had Windows 7 Ultimate.
 
gpedit is on home premium. However the run command didnt work.
I did a full file search to find it and run it that way, but the MMC error occured.

redshadows said:
1. Start Search box type "mmc" and press Enter.
2. Click "File->Add/Remove Snap-ins".
3. In the box of "Selected Snap-ins", click on and remove all entries except "Console root.

Should work
Click to expand...

There was only Console Root in the list, so that didnt get the gpedit working for me :(
 
Im feeling dumb for the 1st time this week, I have no idea how else to get in to group policy editor without gpedit.msc.

Im thinking its something to do with User Account Control thats stopping you but not sure.

I will ask the wife when she gets home from work.


vsmora said:
Have you considered using FTP instead e.g. Filezilla server? Back in the day at uni we used to use normal fileshares but most big sharers moved to FTP to make things manageable. FTP servers include logging of all activity, but will also allow you control over bandwidth and concurrent access, to ensure that the disk/wifi don't get thrashed. As a potential side benefit, FTP also prevents streaming so might let your disks have more idle time (e.g. 10min to copy movie vs 2hr streaming to watch it). It's pretty easy to setup.
Click to expand...

Sorry feeling dumb for the second time I felt I should have thought of this :o
 
Last edited:
Asked the wife, she was network admin for years and has since moved on to be a collage lecturer, I showed her the thread and I quote:

"Eh, Im just back from work, oh why does it say that. It shouldn't say that, let me see"

Followed 10 minutes later with (talking to herself) "Why, **** thats just not right"
30 more minutes passes "Right I give up, I will ask my class"
I couldnt stop laughing with the "ask my class" comment.

She thinks its account control as well BTW
 
Home Premium simply doesn't have everything necessary to enable it. Not without a bit of hacking I'd have thought.
 
You must log in or register to reply here.
Back
Top Bottom