5. System Tray Share Monitor
This tool was first released on 2002, last updated in 2007 and designed to work on Windows XP but still works in Windows 7. Upon running, System Tray Share Monitor monitors and logs incoming connections and the files that are being read and written. There is no notification and double clicking on the tray icon will show a small bar of the user and IP address connected to your shared folder. Double clicking on the user name will bring up another window showing the files currently being accessed.
WhoIsConnected comes with a unique feature called “Disable Login” which is very useful if you want to quickly stop anyone from accessing your shared folders with a single click of a mouse button. Unfortunately Disable Login feature only works on Windows XP but not on Vista and 7. The connection notification can be enabled from the Options window where a notification window will be displayed when someone accesses your shared folder. There is no log support on this tool.
7. The Manual Way
If you’ve gone through all 6 programs above, you may have noticed that there is no perfect tool that comes with all features to monitor your shared folders such as logging, notification, actions and etc. Although they can all tell which files are being accessed and who is accessing them, it is still not possible to show the exact actions by the users such as if the files are being copied or deleted since it only shows read or written. If you need detailed logging information, there is actually a way to enable auditing without using third party tools but it requires more steps. Here is how to do it in Windows 7.
1. Click on the Start button, type Local Security Policy and press Enter.
2. Expand Security Settings > Local Policies > Audit Policy > and double click on Audit Object Access.
3. Tick on the Success checkbox and click OK.
4. Right click on the shared folder that you want to monitor and select Properties.
5. Go to Security tab and click the Advanced button.
6. Go to Auditing tab and click the Edit button.
7. Click the Add button, type EVERYONE at the object name box and click OK.
8. An auditing entry window will open allowing you to log the actions that you want. If you want to monitor deletion of files and folders, simply tick the “Delete subfolders and files” and “Delete” successful checkboxes. Do not tick everything because that will easily fill up the event logs making it harder for you to audit.
Whenever a file on the shared folder which you have enabled auditing is deleted, it will be logged and can be viewed from Event Viewer. Go to Control Panel > Administrative Tools > Event Viewer. Expand Windows Logs and click on Security. The event below is an example of a file x-ray.exe being deleted from the shared folder by the 192.168.2.17.