[magusbuckley]

Hello:

At work, a user sees that someone accessed a file on her computer in the late afternoon. We were all off by the time the file was accessed. We are on a domain. Is there any way to tell when a user logged into that XP machine? According to the Microsoft site, we should have access to that information via the event viewer. Her event viewer has only one entry, and that one is more than a year old.

Is there another way to track this and is it possible to find this information in the active directory?

Any and all information will be greatly appreciated.

Thanks,

magus

[Advertisements]

Magus,

This first step is to enable the Auditing of single files or folders, or in other words to tell who has accessed certain files,

In order for this to work we must disable Simple File Sharing:

Open My Computer, Select Tools from the drop down menus, then select Folder Options
The select the View tab at the top of the Folder Options Window
Scroll to the bottom and Un-check "Use simple file sharing (recommended)"

Next open windows explorer and navigate to the folder or files in question that you would like to monitor the access to.
Right click and select Properties
Select the Security Tab
on the security tab at the bottom click on the Advanced Tab
Then Select The Auditing Tab
Click Add on the auditing tab.
In the Name box Type Everyone and then click Check Names if it is close enough it should Capitalize and Underline Everyone (this works if you just want to audit certain users as well)
Click OK
On the next screen select what properties you want to Audit for the selected users
if you Select the Full Control check box under both successful and failed, you will see every time some one attempts to or access the file or folder we set this up for.


The next step is to enable Auditing for user logins.

For Domain Policy editing i believe the command is GPMC.MSC entered into the Run dialog.

For XP Policy Editing open the Run dialog and type MMC
When the Management console comes up goto File and select Add/Remove Snap-in
On the next Window click Add
On the next window navigate to Group Policy Object Editor and click Add
Press Finsih on the screen that comes up after that.
Then click Close and then Ok

Now We are at The Policy Management Console, I believe from this point on it is pretty much identical between Domain and Single XP Computer.


Expand the Local Computer Policy
Expand the Computer Configuration
Expand the Security Settings
Expand the Local Policies
Click on Audit Policy

From here you can enable Account Logon Events both success and failures.

If you have any questions or if I need to clarify any further, please let me know.

Security Goat

[security_goat]

Magus,

This first step is to enable the Auditing of single files or folders, or in other words to tell who has accessed certain files,

In order for this to work we must disable Simple File Sharing:

Open My Computer, Select Tools from the drop down menus, then select Folder Options
The select the View tab at the top of the Folder Options Window
Scroll to the bottom and Un-check "Use simple file sharing (recommended)"

Next open windows explorer and navigate to the folder or files in question that you would like to monitor the access to.
Right click and select Properties
Select the Security Tab
on the security tab at the bottom click on the Advanced Tab
Then Select The Auditing Tab
Click Add on the auditing tab.
In the Name box Type Everyone and then click Check Names if it is close enough it should Capitalize and Underline Everyone (this works if you just want to audit certain users as well)
Click OK
On the next screen select what properties you want to Audit for the selected users
if you Select the Full Control check box under both successful and failed, you will see every time some one attempts to or access the file or folder we set this up for.


The next step is to enable Auditing for user logins.

For Domain Policy editing i believe the command is GPMC.MSC entered into the Run dialog.

For XP Policy Editing open the Run dialog and type MMC
When the Management console comes up goto File and select Add/Remove Snap-in
On the next Window click Add
On the next window navigate to Group Policy Object Editor and click Add
Press Finsih on the screen that comes up after that.
Then click Close and then Ok

Now We are at The Policy Management Console, I believe from this point on it is pretty much identical between Domain and Single XP Computer.


Expand the Local Computer Policy
Expand the Computer Configuration
Expand the Security Settings
Expand the Local Policies
Click on Audit Policy

From here you can enable Account Logon Events both success and failures.

If you have any questions or if I need to clarify any further, please let me know.

Security Goat