Connection monitoring question 1

[Malchik]

Hi,
Hopefully this question is in the right forum, if not I appologize. Is it possible to know when and who connected to a machine using UNC connection (\\<machineName>\c$)??? I suspect that someone with network admin right sneek in my VB development folder, which I don't like. I would like to be able to log, if possible, which IP connected and what was copied...


Thanks!

Mal'chik

 

[chipk]

This question would probably get more answers in the Enterprise Level Server Management or XP/2000 forums, but...What version of Windows are we talking about?

 

[Malchik]

Windows XP

Mal'chik

 

[chipk]

For starters, see if you are able to turn on Auditing and set it up for your VB development folder:

http://support.microsoft.com/kb/310399/en-us

Group Policy may override these settings, but it's worth a shot. You could always set up your VB dev folder as encrypted if you just want to stop anyone from getting in without necessarily find out who is trying to access:

http://support.microsoft.com/kb/308989/en-us

But with encryption you want to set up a recovery agent just in case you lose access, someone else will be able to get to those files.

Also, if you think someone may have a connection to your pc while you're actually logged in, you can always run the following command from the command prompt, which will show you which computers have open sessions:

c:\netstat

Real-time file access can also be viewed in Computer Management/Shared Folders/Open Files.

You could also just turn on your firewall if GPO or a logon script does not turn it off when you login.

 

[Malchik]

Thanks a lot Chipk i will try your suggestion...

Mal'chik