Trcking user activities like file copy, paste, modification, deletion

[chakka]

Hi all,

I found AutoIt scripting is very useful and I've just started learning it.

Using AutoIt, is it possible to track user activity like file copy/cut, paste, modification, deletion etc for a particular folder or drive

Here in my office there are folders shared among all users with complete permission. Users are not allowed to cut & paste or delete certain files (especially quark express files and pdf). Here We cannot create user roles(to restrict) .Because of resource shortage their roles may vary. in some days they may delete and in some other days they may not.

So here I think best way is to track user activities on that particular folder(path/drive) where we keep those files.

If somebody accidentally/purposefully delete something, that must be logged.

Can you somebody please help me to achieve this? examples?

Thanks

[Tripredacus]

I don't think you can monitor remote computer's clipboard activities... such as what would occur during a copy or cut operation. But even in Windows you have the ability of using folder auditing. There are ways in most Windows OS since at least NT 4.0 when I last used it. Here is an example in Windows XP:

http://support.microsoft.com/kb/310399

[chakka]

Tripredacus, thanks for quick reply.

If Im the Server admin is it not possible to monitor Remote PC actives? or If I can force them to run an Autoit code during Client System startup?

[Tripredacus]

Tripredacus, thanks for quick reply.

If Im the Server admin is it not possible to monitor Remote PC actives? or If I can force them to run an Autoit code during Client System startup?

I think I'd start with the auditing portion, and not bother with tracking Copy or Cut operations on the client machine. I'm not sure those are really worth trying to capture. If you did build an AutoIT app to run on the client side which was running all the time and monitoring the users like that it may end up being too complicated. Think about how maybe your antivirus software might not like it, or that all users may use different methods of getting to the shares, different drive letters, UNC path or IP or whatever else. I'd stick with auditing on the shares themselves to start and see if that is good enough, and then maybe look into monitoring on the client side if you need more than auditing is able to offer you. But you might be able to find audit rules you can run on the client too.

[chakka]

Thanks a bunch Tripredacus, I accept. that's a good Idea to start with auditing. As that doesn't cause to decrease system performance.

Any AutoIt suggestions?

Here in our case, We've a stable share path for those files serverfilestomonitor

(And if drive letter varies no problem there too. coz, we have only single network drive and that can be easily detected via DriveGetDrive ( "NETWORK" ))