Take the 2-minute tour ×

I am currently setting up a file server with win2k8 server r2 (storage server) I was wondering is there something I can use to audit/log what happens?

For example

JSmith moved Folder1 to Root. JSmith created XYZ folder.

etc. Directory Monitor doesn't show users (which is important) http://www.deventerprise.net/Projects.aspx

Obviously something with low overhead would be awesome too.

Thanks in advance

share|improve this question
add comment

5 Answers

up vote 3 down vote accepted

If you are open to spending a little bit of money to get reports that are easily generated and easy to read, I highly recommend File System Auditor by Scriptlogic.


This software lets you create custom reports showing any activity in any folder, by any user, and any type of event. It is orders of magnitude easier to read and use than the default auditing built into Windows Server. I use it on my file server which is running Server 2003 but I am sure it will run great on 2008 as well.

share|improve this answer
Does this track folder moves and renames? Thanks. –  Kvad May 16 '10 at 23:34
Yup sure does. It actually shows the original name of the file or folder, then the destination file or folder name. –  user10711 May 18 '10 at 16:31
add comment

You can enable auditing on Windows Server and use Logparser to parse the logs to suit your needs. Logparser is a free tool from Microsoft. It allows you to parse *.evt logs to any format you like (fixed column length, csv, txt, graphs etc.). The SQL like syntax is very flexible in extracting the relevant information.

share|improve this answer
add comment

You need to turn on Auditing on. Check the following link for a an explanation of how to enable auditing and track what is happening. Overhead should not be an issue if properly set up, ; ex add only certain users in the audit versus everyone.


share|improve this answer
Thats on now, but is there anything to use it for nice reporting tools ? –  Kvad May 14 '10 at 6:21
add comment

for nice reporting use http://www.eventlogxp.com/

Hope this helps!

share|improve this answer
add comment

This might be what you are looking for: Win Server 2008

This solution involves turning on Windows Server built in Audit policy for files and folders.

Excerpt:"To enable file and folder auditing for a single server, select Start -> All Programs -> Administrative Tools -> Local Security Policy"

share|improve this answer
Merely linking to an article and not explaining it in the text of your answer is not in-line with the intent of this site. –  mfinni May 17 '12 at 12:49
Edited. Please upvote it now. –  Dragos May 18 '12 at 12:43
That's only half of the relevant instructions - you then have to turn on auditing for the files and/or folders you care about. –  mfinni May 18 '12 at 15:47
add comment

Your Answer


