Brainbox.cc is an IT service provider.
Every now and again someone accidentally deletes data from our server. After restoring the data from a backup or shadow copy, the next inevitable question from upper management is "who did this, find out who and find out why they did it". We have a DFS environment with two sites, and audit logging turned on across both sites, but filtering and managing this audit log is beyond the realms of sensible. Can anyone please recommend an affordable solution that will provide simple reports for upper management of who changed what and deleted which files on any particular day or week, which is also compatible with multiple sites on a windows domain with DFS?
Thanks for the shout for FileAudit.
Yes FileAudit can help you here and offers very affordable pricing. FileAudit constantly examines and records read/write/delete accesses etc (or access attempts) – in real time - so IT or management can immediately address any inappropriate accesses.
Agentless, remote and non-intrusive; FileAudit offers an easy yet robust tool for monitoring, auditing access to files, folders and file shares that reside on Windows Systems.
Best file copy program to utilize bandwidth on Teamed NICs?
Keep IT Simple Technology Group is an IT service provider.
Edited my original post as I missed the management reports previously.
Netwrix is the best. Great presence in the community, and may great free and paid products.
We use Lepide Auditor suite to monitor our 2 files servers. It works great and you can have reports emailed to you.
Ive tested both Lepide and Netwrix. Both did a great job with this. Lepide was cheaper.
For this feature, I preferred Lepide. We have large volumes, Lepide was more efficient on its storage usage. I also found its reporting easier and better.
Other issues we have with Netwrix, it required SQL reporting sevices. This was not installed on our main SQL server. with the large shares we had, we would have out grown what SQL Express can do in a month.
With that, we did go with Netwrix. This is because of other features that Lepide failed or fell short of.
Thank you for recommending LepideAuditor Suite.
You can try Lepide file server auditing tool to track such changes/access made on your file server. It alerts instantly by sending customized email notification with real time reports.
We use FileAudit (isdecisions)for this.
Thanks, i've downloaded Lepide to take a look, but i'm still open to further suggestions!
I also get deterred by vendors who want you to get called by a pushy sales person just to get an idea of costs.
Lepide included 2 years maintenance, Netwrix included 1 years.
Both are licensed by active users within Active Directory. So if you are like me and have a bunch of service accounts you get hit hard on those.
I found both to be well priced and of great value. This is based on 170 users, your millage will vary.
Netwrix Auditor is licensed based on number of AD Users. There are also discounts, etc.
Could you please let me know how much users you have?
Thanks very much for the reply! We currently have a total of 35 active users in active directory spread over two physically separate sites.
Hopefully you can provide a competitive price.
Thank you, I just sent message to your inbox.
I would probably take a look at EventSentry, since you would only need to license it for your file servers and not per user. I'm not familiar with pricing but I have a feeling it will be more affordable (it sounds like cost is an issue).
EventSentry offers a lot more functionality in addition to file access auditing, but it should definitely be able to answer the question who did what when. Unfortunately it won't be able to tell you why :-). You can see it in action on their live demo.
Netwrix and Lepide focus on auditing, so you will likely find those products a little easier to setup and more focused on that area, but your requirement is pretty straightforward and you should be able to get what you are looking for with EventSentry's file access tracking.
After looking at some of the options above i've realised that we've overlooked one simple solution. For the detail of logs that we need, and the amount of time taken to create it, we could utilise our own in-house software developers to create our own web-based SIEM solution.
I've taken a few hours to create a simple framework and if anyone is interested i will let you know how this turns out. It might make a good tutorial/article for here on spiceworks.