How to Log files Accessed by user

[jbollman]

I have a need to find out if a user has accessed a file. The users are all using Win98 and the server is NT 4.0. Auditing was not turned on.
*Can I tell from the workstation what network files has been accesse?
*Can I tell from the Server?

Thanks

 

[pansophic]

It has probably been too long at this point, but if you looked through the swap file on that user's computer, you may be able to find fragements of the document if it swapped.

None the less, I would definately turn audit loggin on (better late than never).

Also, there may be some form of auditing built into the application that they used to view it. For instance, if they used an MS Office application to view it, there will be a registry entry created including that file name. That is how the recently viewed documents list is maintained both for the office applications and for the Documents listing in the Start menu.

Run regedit.exe and export the registry. Then you can do a string search for your file name.

pansophic