Jump to content
Sign in to follow this  
chakka

Trcking user activities like file copy, paste, modification, deletion

Recommended Posts

chakka

Hi all,

I found AutoIt scripting is very useful and I've just started learning it.

Using AutoIt, is it possible to track user activity like file copy/cut, paste, modification, deletion etc for a particular folder or drive

Here in my office there are folders shared among all users with complete permission. Users are not allowed to cut & paste or delete certain files (especially quark express files and pdf). Here We cannot create user roles(to restrict) .Because of resource shortage their roles may vary. in some days they may delete and in some other days they may not.

So here I think best way is to track user activities on that particular folder(path/drive) where we keep those files.

If somebody accidentally/purposefully delete something, that must be logged.

Can you somebody please help me to achieve this? examples?

Thanks

Share this post


Link to post
Share on other sites
Tripredacus

I don't think you can monitor remote computer's clipboard activities... such as what would occur during a copy or cut operation. But even in Windows you have the ability of using folder auditing. There are ways in most Windows OS since at least NT 4.0 when I last used it. Here is an example in Windows XP:

http://support.microsoft.com/kb/310399

Share this post


Link to post
Share on other sites
chakka

Tripredacus, thanks for quick reply.

If Im the Server admin is it not possible to monitor Remote PC actives? or If I can force them to run an Autoit code during Client System startup?

Share this post


Link to post
Share on other sites
Tripredacus

Tripredacus, thanks for quick reply.

If Im the Server admin is it not possible to monitor Remote PC actives? or If I can force them to run an Autoit code during Client System startup?

I think I'd start with the auditing portion, and not bother with tracking Copy or Cut operations on the client machine. I'm not sure those are really worth trying to capture. If you did build an AutoIT app to run on the client side which was running all the time and monitoring the users like that it may end up being too complicated. Think about how maybe your antivirus software might not like it, or that all users may use different methods of getting to the shares, different drive letters, UNC path or IP or whatever else. I'd stick with auditing on the shares themselves to start and see if that is good enough, and then maybe look into monitoring on the client side if you need more than auditing is able to offer you. But you might be able to find audit rules you can run on the client too.

Share this post


Link to post
Share on other sites
chakka

Thanks a bunch Tripredacus, I accept. that's a good Idea to start with auditing. As that doesn't cause to decrease system performance.

Any AutoIt suggestions?

Here in our case, We've a stable share path for those files serverfilestomonitor

(And if drive letter varies no problem there too. coz, we have only single network drive and that can be easily detected via DriveGetDrive ( "NETWORK" ))

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×