如何跟蹤和監測誰，并且某人當時在您的計算機訪問一個文件夾!

張貼在2007年3月11日在1:23上午

有允許您跟蹤的一個好的小的特點被建立入窗口當某人觀看，編輯或者刪除某事裡面一個指定的文件夾時。如此，如果有您要知道的文件夾或文件誰訪問，然後這是固定方法，无需必須買所有另外的軟件。

這個特點實際上作為叫的系統的部分 小組政策多數使用它專家使用服務器在公司網處理計算機，然而，這個政策系統可能當地也使用，不用任何服務器。

期限小組政策基本上提到一套可以是受控的通過一個圖形用戶界面的登記設置。您使能或使設置失去能力，并且這些在窗口登記編輯被更新。

要有政策編輯，點擊開始然後跑。

在文本框，如下鍵入「gpedit.msc」，不用行情如所示：

現在您應該看於圖像是相似的如下的事：

有政策二個主要類別：用戶和計算機。因為您也許已经猜測，用戶政策控制設置為每名用戶，而計算機設置將是系統寬設置，并且影響所有用戶。在我們的情況我們要我們的設置是為所有用戶，因此我們將擴展我們計算機配置部分。

持續擴展 安全設置-> 地方政策-> 審計政策. 因為這primairly集中於驗核文件夾，我不這裡解釋許多其他設置。現在您在右邊將看一套政策和他們的當前設置。審計政策是什麼控制是否配置操作系統并且準備跟蹤變動。

現在檢查設置為 審計對象通入 通過雙擊對此和選擇成功和失敗。點擊OK和我們現在做是告訴窗口的第一個部分我們要它準備監測變動。現在下一個步驟將告訴它什麼我們確切地想要跟蹤。您能現在關閉在小組政策控制臺外面。

現在駕駛對文件夾使用您希望監測的Windows Explorer。在探險家，用鼠標右鍵單擊在文件夾并且點擊物產。點擊安全製表符，并且您看事相似於此：

現在點擊先進的按鈕并且點擊Audting表格。這是我們實際上將配置的地方什麼我們想要為這個文件夾監測。

開始并且點擊增加按鈕。對話將看上去要求您選擇用戶或小組。 In the box, type in the word "users" and click Check Names. The box will automatically update with the name of the local users group for your computer in the form COMPUTERNAME\Users.

Click OK and now you’ll get another dialog called "Audit Entry for X". This is the real meat of what we’ve been wanting to do. Here is where you’ll select what you want to watch for this folder. To make things easier, I suggest selecting Full Control, which will automatically select all the other options below it. Do this for Success and Failure. This way, whatever is done to that folder or the files within it, you will have a record.

Now click OK and click OK again and OK one more time to get out of the whole multi-dialog box set. And now you have sucessfully configured audting on a folder! So you might ask, how do you view the events?

In order to view the events, you need to go to the Control Panel and click on Administrative Tools. Then open up the Event Viewer. Click on the security tab and you’ll see a large listing of events on the right hand side:

If you go ahead and create a file or simply open the folder and click the Refresh button in the Event Viewer (the button with the two green arrows), you’ll see a bunch of events in the category of Object Access. It’ll also list the user and computer. Now if you have a computer with multiple user accounts, then you can just scroll through the list and see if the object access message is there with another user name listed. However, if you think someone might be viewing items under your name, you’ll have to instead scroll through and look at the date and time.

In order to make it easier to look through so many events, you can put a filter and just see the important stuff. Click on the View menu at the top and click on Filter. In the Event ID box, type in the number 560. This is the event associated with a particular user performing an action and will give you the relavant information without having to look through thousands of entries.

If you want to get more information about an event, simply double click on it to view.

This is the information from the screen above:

Event Type: Success Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 3/11/2007
Time: 2:57:35 AM
User: RELIAGENETECH\akishore
Computer: ASEEM

Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: D:\Test\New Microsoft Word Document.doc
Image File Name: C:\WINDOWS\explorer.exe
Primary User Name: akishore
Accesses: READ_CONTROL SYNCHRONIZE ReadData (or ListDirectory) WriteData (or AddFile) AppendData (or AddSubdirectory or CreatePipeInstance) ReadEA WriteEA ReadAttributes WriteAttributes

Here I created a new Microsoft Word document in the Test folder and it tells me that the object type was a file and Explorer was being used by user akishore. And I performed a read and a write according to the "Accesses" section. If you just want to see if someone else is accessing a folder, then simply look at the entries date and time or user fields.

And that’s it! A quick and free way to track access or changes to a folder!

Technorati Tags: monitor computer activity, monitor folders, track file changes, track folders

If you enjoyed this post, make sure you subscribe to my RSS feed!

» Filed Under Windows XP

One Response to “How to track and monitor who and when someone accesses a folder on your computer!”

Alternate Method - Using Google Desktop to track and monitor the activity on your computer Says:

[…] subscribe to my RSS feed to get daily tips. Thanks for visiting!I just read my post about trying to monitor what activity is occurring on your computer and realized that its way too complicated to get working and even if you get it working, […]
October 10th, 2007 at 11:01 pm