does windows sever ...
 
Notifications
Clear all

does windows sever 2003 log who is open office 2003 file ??

7 Posts
6 Users
0 Likes
470 Views
(@qassam22222)
Posts: 155
Estimable Member
Topic starter
 

hello there ……
i shared an word file ( office 2003 ) for all i mean all users on my server can see this file !!
my problem is is there anyway to find out who view my file at a specific time
does the word has logging features ??

note i didnt enable my server logging (

 
Posted : 04/10/2016 1:44 pm
(@bithead)
Posts: 1206
Noble Member
 

hello there ……
i shared an word file ( office 2003 ) for all i mean all users on my server can see this file !!
my problem is is there anyway to find out who view my file at a specific time
does the word has logging features ??

note i didnt enable my server logging (

In short probably not. You did not revel if this is a server on your local LAN or a web server on the Internet so your "all i mean all users" is not as helpful a clue as you likely intended.

Also you did not give any details about your server other than you didn't enable logging. Linux of some flavor, Windows, Mac, Open BSD, hard to guess what default logging might have been enabled. You did not describe your environment, also a necessary clue. Is this a Windows Active Directory environment where you might have a chance at some event logs that could be tied to a user account? Where you might be able to perform some remote forensics once you correlate your logon events? Or a workgroup with a shared logon account? Or a Netware network?

One of the keys to getting helpful answers is to provide as much detail as you can including what you are trying to prove.

 
Posted : 06/10/2016 5:39 am
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

hello there ……
i shared an word file ( office 2003 ) for all i mean all users on my server can see this file !!
my problem is is there anyway to find out who view my file at a specific time
does the word has logging features ??

note i didnt enable my server logging (

No, but it's entirely possible, depending upon if the client systems are Windows and what versions of Windows, that the fact that they opened the file will exist in their NTUSER.DAT Registry hive.

Also, which version of Word was the document opened in? If an older version, that uses OLE format for Office/MSWord documents, you _might_ have some information embedded in the document itself. Maybe.

 
Posted : 03/12/2016 4:39 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

With Windows 2003 Server you could check the file's Last Accessed Time.

If you need other previous file access times, I don't think there is any trail of it without specially set up logging.

 
Posted : 04/12/2016 5:04 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

With Windows 2003 Server you could check the file's Last Accessed Time.

And maybe you could get the "when", but never the "who".

jaclaz

 
Posted : 04/12/2016 11:22 pm
(@tabeer)
Posts: 7
Active Member
 

5
down vote
I believe you are going to want to refer back to Sky100's post as he is correct, not in providing you with what you asked, but in providing you with what you need to resolve your issue. You will need to reference the locked ID number via the "openfile /query /v" (verbose) command as it will supply you with the data you need. Search for the file name within the list given, the data will show which item has the read & write enabled, and along with it will provide a specific ID number. No, you may not be able to find which specific system has the file locked, but with the tools provided, you can disconnect that user from the file. Here is a step-by-step to simplify my ramblings.

1) On the fileserver with Administrator rights, do Start > Run > CMD [ENTER]

2) CD Desktop [ENTER] (You'll see why soon.)

3) openfiles /query /v > file.txt [ENTER] (This will create a file on the desktop with a list of all the opened files on the server.)

4) Open the file.txt and search for the line containing both your file name and the Read + Write permissions.

5) Note the ID number on that line and go back to your Command console.

6) openfiles /disconnect /ID [Put ID Number Here] [ENTER]

As long as you have Administrative rights on the file server, it will disconnect that system from the file and assuming your system is automated, should allow things to keep moving along as needed.

References openfiles /query /? openfiles /disconnect /?

If you are in need of a script or programmed application catered to your system, please feel free to comment and I will provide with contact info, a very low price along with tech. support on my application.

 
Posted : 06/12/2016 5:33 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

@Tabeer
What is the sense of copying and pasting a reply provided (by Thomas in 2010) on Serverfault?
https://serverfault.com/questions/109276/how-to-tell-what-computer-has-a-file-open-on-a-network-share/294936

jaclaz

 
Posted : 06/12/2016 7:27 pm
Share: