I have a desktop and laptop at home and I periodically need to transfer my files between two computers. Problem is sometimes I’d forget to unshare the shared folder because in my home network, there’s only me connecting to it. There was a serious issue which happened on my laptop few days ago. I was at my client’s place to configure their server and I brought my laptop along. My laptop was connected to their network the whole day and at night when I got home, I noticed all my files in my shared folder is gone!

At first I wanted to call up the manager to ask him to query his employees who did it but after thinking for a while, I prefer to catch the sucker red handed and I did! What I did was pretty simple. I shared a few more folders and copy some unimportant files with filename that “looks” important (such as mypassword.txt, banking.txt and etc). I ran a tool that can monitor my shared folders to see which user delete the files. Sure enough the next time I went to my client’s place again, the sucker connects to my computer again and started checking out all my files in shared folders.

I’ve previously introduced a tool called NetShareMonitor. Just download and run the tool. It will sound an alarm when someone access your shared folder. However, it is not capable of telling me what file did the user accessed in the shared folder.

Here is shared folder monitor called System Tray Share Monitor. This tool can tell what file the user is actually accessing and logs it down for your future references.
ShareMonitor

If you want to track users who needs to login first, then you don’t need the tools above. You can just enable auditing for shared folders. Here’s how to do it in Windows XP Professional.

1. Go to Control Panel > Administrative Tools > Local Security Policy.

2. Expand Security Settings > Local Policies > Audit Policy.

3. Double click on Audit object access and check the Success checkbox. Click OK and close Local Security Settings window.

4. Go to Control Panel > Folder Options > View tab, scroll right to the bottom at Advanced settings and uncheck “Use simple file sharing”. Click OK.

5. Right click on the folder that you want to share and select Sharing and Security…

6. Select Share this folder.

7. Go to Security tab, click Advanced button, go to Auditing tab and click Add button. Enter EVERYONE as object name and click OK.

8. Now a selection box will be displayed. Choose only the options that you need. If you want to see who delete your files and folders, just check the successful checkbox for Delete and Delete Subfolders and Files. Click OK once you’ve done your selection and also OK through all of the windows you have open.
Windows Auditing Entry

9. To view who deleted your files and folders on your shared folder, go to Control Panel > Administrative Tools > Event Viewer and view Security. The security event logs will tell you which user deleted what files.

Now when someone access your shared folders and deletes a file in there, you have no problem knowing who did it.

Technorati Tags: , , , ,