How can I determine who created or modified a file on Win2k server without using detailed auditing?

I'm not sure how you have your settings. I'm not sure what you mean by "detailed auditing." In Windows 2000, if you look at the properties of a file, click the Advanced button, then the Owner tab, this will tell you the owner of the file. If the file was created by an administrator it will list the administrators group, as well as the administrator. If this setting has not been changed, this will be the creator of the file. To determine who has modified a file, or who was the true original creator you must turn on auditing. Here's how:

1. In Administrative Tools\Local Security Policy\Local Policy\Audit Policy turn on Audit Object Access for success and failure.
   
2. Then, using Windows Explorer, access the audit properties of the files and/or folders to audit and turn on auditing for the user or group you wish to track. If you select the Authenticated Users group, this will provide audit records in the Security Log for the individual user who has modified, or otherwise accessed the file.

Yes, Unix systems do things differently. But in most systems, including Win2k the "owner" of the file is not necessarily the original creator of the file. Auditing will provide you with that information. But in Windows 2000, auditing must be turned on in order to record it.

Download this free guide

Free PDF: Your Essential Guide to Unified Endpoint Management

Download this 44-page guide to learn everything you need to know about UEM.

Start Download

• Corporate E-mail Address:

  You forgot to provide an Email Address.

  This email address doesn’t appear to be valid.

  This email address is already registered. Please login.

  You have exceeded the maximum character limit.

  Please provide a Corporate E-mail Address.

• • I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.

  Please check the box if you want to proceed.

• • I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.

  Please check the box if you want to proceed.

By submitting my Email address I confirm that I have read and accepted the Terms of Use and Declaration of Consent.