File Access Tracking

If you configured File Access Tracking to write to the database then you can run queries to search for a file access history on the File Access Tracking page.

•	Complete history of file access in any monitored directory

•	See which users are accessing/modifying files in a folder

•	The logon id, to track a file change back to a logon event

The files access tracking query page gives you the same flexibility the database query page gives you, allowing you to construct your own powerful queries with just a few clicks.

Prerequisites:

A Tracking Package that includes a File Access Tracking object needs to be assigned to one or more computers and auditing needs to be enabled for the directory that needs to be monitored.

This is the computer where the files that were accessed where physically located. Files could have been accessed either locally (e.g. from a workstation or terminal server) or remotely (e.g. through a file share on a file server).

The source computer is the computer from which the file change was requested. If the file change was made through a file share, then the source computer name will be different from the computer name. This field will only be populated if the package is configured to retrieve the source computer and IP address.

The user account who initiated the file change. If the username contains a $ sign at the end, then it indicates that the change was initiated by the computer itself - e.g. by a service.

The directory in which the file was modified, or the directory that was changed if the file access pertained to a directory only.

If the file was accessed directly by local process (not through a network share, in which case this field is not useful), then this field contains the process name and path (if available).

The logon ID of the user who accessed the file. This can be used to correlate file access activity to other actions such as process activity, network logons and so forth.

The action that EventSentry determined was applied to the file. Since the windows event log, especially on Windows Server 2003 and earlier, does not actually indicate what action was performed, EventSentry tries to determine the action that was performed on the file. This is only available if the directory being monitored has the event analysis set to either "Normalize & Verify" or "Normalize, Verify and Filter".

You can restrict a search so that it only includes files access information that was or was not verified by the EventSentry agent. Please note that a file action can only be "Verified" if if the directory being monitored has the event analysis set to either "Normalize & Verify" or "Normalize, Verify and Filter".

The access mask, as reported in the object access tracking events. For searching, you can either specify the complete access mask or check any access mask to filter the search results.