Logging reports on checking other computers

Question

Hello,

In a Windows domain network, if someone sees another computer's drive (via C$), is it possible to find out through Active Directory or other services?

Thank you.

Answer 1

Hi Windows.Geek,

Have a nice day!

There is no way to directly find out which user has viewed the contents of which user drive through Active Directory alone.

However, many file servers (such as SMB/CIFS shares on Windows Server) support audit logging features that can record which users accessed which files.

By enabling and configuring these audit logs, administrators can view file access history after the fact to see which users viewed the contents of which user drive.

First, you need to log in to the file server's management console as an administrator.

Depending on your server type and configuration, select the appropriate service or tool to view the audit logs. For example, on Windows Server, use Event Viewer or a file server configured with a specific audit policy.

In the Management Console, find and locate the location where the audit logs are stored. This might be a specific log file, database, or interface.

Use the appropriate tool or method to open and view the audit logs. This involves filtering, sorting, and searching for specific log entries.

Best regards

Neuvi Jiang

Answer 2

Hi,

Thank you so much for your reply.

No, I didn't mean that. Is it possible to find out which user has seen the contents of which user's drive through Active Directory or other services?

Answer 3

Hi Windows.Geek,

Thank you for posting in the Microsoft Community Forums.

In a Windows domain network, although Active Directory itself does not provide the ability to directly locate shared drives (such as C$), you can indirectly obtain the information by looking at the Computer object, utilizing Group Policy, and so on.

In the AD User and Computer Management tool, you can search for all computer objects in the domain. These objects contain basic information about the computer, such as name, IP address (if registered), and so on. Note, however, that this information does not directly show which computers share which drives.

Best regards

Neuvi Jiang