User monitoring

LillyVanilli

Hi,

Can anyone recommend some software that I can use to monitor active directory users? Basically I just need some simple software that can show which users are trying to access certain resources?

Thanks

Static M.e.

Can anyone recommend some software that I can use to monitor active directory users? Basically I just need some simple software that can show which users are trying to access certain resources?

Never heard of any sorry.

Is it for a specific resource?

LillyVanilli

Not particularly, its just to monitor a certain user. Something simple that will tell you when they log on and try to access files.

CptSternn

Do you have an SMS server? SMS offers many solutions that could do what you want and more. Also, what about modifying your domain policies to track this user?

DannyBuoy

You might be able to change the std settings in the Event Viewer to cater for your needs, there are various options in there that might help...

_CreeD_

You can do this from inside the server itself. Modify an existing or create a new GPO (or just edit the server local policy) and enable COMPUTER CONFIGURATION / WINDOWS SETTINGS / SECURITY SETTINGS / LOCAL POLICIES / AUDIT POLICY / Audit Object Access, apply the GPO to your server(s) . If you have 2003 run GPUPDATE /FORCE to make the change take affect immediately. On 2k you'll have to use "secedit /refreshpolicy {machine_policy | user_policy}[/enforce] ", fill in the variables as you want. Alternatively just wait about 90 mins. Regardless once the policy is applied you will be able to audit file access. Find the drive/folder/file(s) you want to monitor and select it's Properties / Security / Advanced and Auditing. Select the User(s) or Group(s) you want to monitor then tick the following selection box for the types of access you want to record (for everything just to full control, for deletes etc. just choose those options, it's pretty granular). Apply it all and the audit results will be available under Event Viewer / Security as they happen from then on (i.e. it doesn't do a review, it only works from that point forward).

LillyVanilli

Thanks guys, Ill try do that