Mark Minasi's Tech Forum
Register Calendar Latest Topics
 
 
 


Reply
  Author   Comment  
cspanburgh

Avatar / Picture

Senior Member
Registered:
Posts: 226
Reply with quote  #1 
Hi folks.  I have a client that has hundreds of folders of archived data.   

Is there a tool that you like to show the last time a file was opened and perhaps allows for a report to be made. 

I guess a file server audit tool of some sort that is not too intrusive in a domain?

__________________
Curt Spanburgh
0
cj_berlin

Avatar / Picture

Senior Member
Registered:
Posts: 258
Reply with quote  #2 
Curt,

NTFS has a "Last access time" attribute which may not always be reliable. The simplest way to do this for a folder tree would be PowerShell:
Code:

Get-ChildItem <path to root of folder tree> -Recurse | Select FullName, LastWriteTime, LastAccessTime | Export-CSV c:\temp\file_report.csv -NoTypeInformation -Delimiter ";"

or something along these lines. This won't show you who accessed the files, though, or where from. If you need that, you will usually
  • Enable "Audit Object Access" on file server(s)
  • Filter the resulting EventLog and dump it into Splunk, LogInsight or whatever tool you are most comfortable with or have at hand
  • create the report form there.
Of course, this process is not retroactive so you will not see who accessed a file BEFORE you enabled auditing.

__________________
Evgenij Smirnov

My personal blog (German): http://www.it-pro-berlin.de/
My stuff on PSGallery: https://www.powershellgallery.com/profiles/it-pro-berlin.de/
0
cspanburgh

Avatar / Picture

Senior Member
Registered:
Posts: 226
Reply with quote  #3 
Thanks CJ.
__________________
Curt Spanburgh
0
Previous Topic | Next Topic
Print
Reply

Quick Navigation:

Easily create a Forum Website with Website Toolbox.