Tracking File and Network Activity

[OUCATS]

I am in a bit of a bind. We have an employee who resigned today and left no notice that he was resigning. Management is concerned with him possibly taking files or viewing other files for information before he left.

Now my question...
I know you can use auditing in 2000 Server to track changes and who viewed what files. But the problem is that this is a small company and they have never been concerned with this type of a problem so we didn't have auditing turned on. Is there any way to track employee network steps without using auditing?? Is there any third party software that can do this after the fact??

Sorry if this isn't complete, I'm trying to get this posted quickly.

Thanks!!

 

[ntwrkadmn]

There is a tool available called File Watch that monitors file activity and creates a log file for you to monitor. Go to

http://www.foundstone.com

\resources \ free tools. If your not familiar with this site you may want to bookmark it. I've learned allot from Foundstone and feel allot better about the networks I administer following their advice. Let me know what you think - hope this helps.

 

[OUCATS]

Does File Watch allow me to see what activity has occured in the past or is this a program that after installed would start tracking activity going forward?

Thanks!

 

[ntwrkadmn]

From this point going forward. I don't think you'll find anything that will onitor the past. If you were creating a log file then theres tools that will find the log files and report the data, but you never had auditing turned on - or any other type of monitoring so I don't think you'll be able to monitor past activity. You can prepare yourself for the future though.