Monitoring when a file has been accessed?

[fatboyjim]

I have Win2K pro and would like to do the following

My brother has the internet via a proxy server running on my PC.

It isn't unmonitored and I have install VNC which is permanently open to check that he's not looking at anything suspect. However, one of his friends came over and showed him something questionable to say the least.

I banned him from the internet for a week and have now blocked a lot more sites. However, there is something I'd like to do (which would be less hassle), there's an HTML file on my system which the proxy server shows to him whenever it has blocked a site from him

How can I tell when this has happened? Is there something I can do to let me know he has had a site blocked from him today?

Thanks,

[Blakhart]

Every file access is updated by last access, a switch in the reg that is enabled by default. It can show you exactly what you are looking for. A possible prob is that it will show you every time a file is handled in any way. It is up to you to root to the file you want to inspect. I know of no app in windows that will alert you any time said file is accessed, not that there isn't one, perhaps there is, or a script may be written for it.

[Laptop Slave]

I am not sure if this will be of help in your particular situation, but there is a feature called auditing that is part of Windows 2000. If the file you want to track is on an NTFS partition right-click on it and go to properties. Click the security tab and then click the Advanced button at the bottom. Select the Auditing tab and then click the add button to add the name of the user who's access you want to track. You then need to select which events you want to be alerted of. In your cae the Read Data and Execute File options should do it. Click the Successful and Failed for both options. Auditing is taxing on system performance. Try not to turn on too many features.

The second part of all this is to turn on the Audit Object Access in the Local Computer Policy.

Go Start>Run Type MMC in the Open: box. Click Console>Add/Remove Snapin... Click Add, scroll to and select the Local Computer Policy and click Add. You may also want to add Event Viewer to the same MMC Console.

Within the Local Computer Policy expand Computer Configuration>Windows Settings>Security Settings>Local Policies>Audit Policy. In the right pane double click Audit Object Access and check Success and Failure. Save the Console, or make a short cut to it, on the desktop for quick access.

Hope this was helpful. Microsoft may have a better detail procedure on their web site.

[fatboyjim]

I'm not at home right now but that certainly sounds like a perfect solution

I'll give it a go when I get back, thanks for the help

Jim

[fatboyjim]

Ok, done all of that

Just to recap, how exactly do I check when this file has been accessed? In Event Viewer?

Thanks

Jim