locked
when any domain user copy data from file server to past anywhere then how to trace via event log RRS feed

  • General discussion

  • Hi Support,

    when any domain user copy data from file server to past anywhere then how to trace via event log.

    Sunday, July 1, 2018 9:59 AM

All replies

  • Hi, 

    There is no way to do this built-in. You should look at third party tools for this. Varonis might be an option, but I am sure you can find others. 

    Philippe

    https://blog.meestart.com

    Sunday, July 1, 2018 10:11 AM
  • A copy is technically a read operation. So if the copy is written to the file system, as opposed to written to memory, there will be corresponding event log entries. LepideAuditor for File Server may help you to get this done easily and efficiently.


    Monday, July 2, 2018 11:56 AM
  • Hi,

     

    Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.

     

    Best Regards,

    William


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, July 3, 2018 8:06 AM