How can I determine who created or modified a file on Win2k server without using detailed auditing?

Published: 08 Oct 2002

With the exception of turning on detailed auditing, which can impact system performance (too late for it now anyway), how can I determine who created or modified a file on a Win2k server? It appears that if an administrator or the system creates a file/directory, the system just states it was created by the "Administrators" group. Therefore, I am unable to determine if it was a specific admin, a batch job or a service running as system. What happened to the owner being identified? Maybe I am just used to Unix.

I'm not sure how you have your settings. I'm not sure what you mean by "detailed auditing." In Windows 2000, if you look at the properties of a file, click the Advanced button, then the Owner tab, this will tell you the owner of the file. If the file was created by an administrator it will list the administrators group, as well as the administrator. If this setting has not been changed, this will be the creator of the file. To determine who has modified a file, or who was the true original creator you must turn on auditing. Here's how:

Step 2 of 2:

You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

This email address is already registered. Please log in.

You have exceeded the maximum character limit.

Please provide a Corporate Email Address.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.

In Administrative Tools\Local Security Policy\Local Policy\Audit Policy turn on Audit Object Access for success and failure.
Then, using Windows Explorer, access the audit properties of the files and/or folders to audit and turn on auditing for the user or group you wish to track. If you select the Authenticated Users group, this will provide audit records in the Security Log for the individual user who has modified, or otherwise accessed the file.

Yes, Unix systems do things differently. But in most systems, including Win2k the "owner" of the file is not necessarily the original creator of the file. Auditing will provide you with that information. But in Windows 2000, auditing must be turned on in order to record it.

Backup scheduling best practices to ensure availability

Security Think Tank: Risk-based response critical to protect data

Create a Custom ISO for Windows 10 -- Part 3 of 6

image metadata