XP Auditing Question

November 10, 2010 at 15:26:14
Specs: Windows XP
I'm managing a computer network that has a computer running XP Pro as a "server." The problem I'm running into is one user keeps deleting files. The way the network is setup all XP workstations log in under guest to the XP Server. I'm limited on what I can get to and change on the server it is a long story but more or less the owners are paranoid yet are not paranoid enough to buy a real server.

I was wonder if there is a way to make audit actually show which computer either by IP or by computer name is deleting the files on the server?

Is there a way to make a warning message anytime you move or delete a file on their end? Even that would be a step in the right direction.

See More: XP Auditing Question

Report •

November 10, 2010 at 15:30:32
computers and ips don't delete files.

until users logon as themselves there is nothing you can do along auditing lines.

Perhaps its time to put a keyboard logger on each pc to record their events.

How to properly post a question: http://tinyurl.com/2fsqqmu

Report •

November 10, 2010 at 15:48:27

I understand that computers and IPs don't delete files I was just wondering if their was a way to track from which computer they are deleting the files from on the "server." Since each person has their own computer to access the files on the "server." Unfortunately with the paranoia keyloggers would not be an option and giving each user their own login in is out of the question too. I've already told them with the setup they have it isn't likely possible but I figured I would go home and do some research.

Report •

November 10, 2010 at 16:52:14
They are not paranoid. They are uneducated. If they were paranoid they would be using user accounts and guest wouldn't be enabled. And it wouldn't stop there. Then you would be able to audit.

Even if you found out who was deleting files odds are the management wouldn't do anything about.

Consider installing a undelete program that captures files deleted via the network. At least you would have easy recovery.

How to properly post a question: http://tinyurl.com/2fsqqmu

Report •
Related Solutions

Ask Question