Hi,

I have file sight ultra , and I added a local disk for watching activities. What I need is the username in our domain that trigger the monitored actions(delete,move or rename files or folder) but what i get for all actions is with the only user NT AUTHORITY for all my users actions. When I check the option for ignoring a user, I can see the list with all the correct users but they just not show in in the logs. could you please tell me how to fix this please?

Regards

asked 24 Sep '14, 13:55

kanjisan's gravatar image

kanjisan
112
accept rate: 0%


Hi

The drive that you added it accessible from the network without logging into the server where PA File Sight is monitoring?

Also, how do the users access the documents on the drive? (log in to server, web access, etc.)

Thanks
Quinn

Please make sure to mark your questions accepted when you have your answer by clicking the gray check mark to the left of the answer.

link

answered 25 Sep '14, 09:30

Quinn's gravatar image

Quinn ♦♦
14.1k3925
accept rate: 37%

The users login in their session with their AD account, then the login script map the share drive with the documents (the n: drive for our case).

The documents are hosted in a DFS file servers that you need at least to be a domain user to access the files. The File sight is installed in this DFS server.

Before we had a cluster of 2 file servers with a different path to access the documents, and our File sight was working perfectly by logging every username actions.

The new servers are in DFS and use a different path to access the files, instead of our old \server-name share we have a path that looks like \domain-name share,

beside to change the new path in the login script, nothing has been changed for users, and i reinstalled File Sight I kept the same configuration on the new server.

Any idea ?

link

answered 26 Sep '14, 11:58

kanjisan's gravatar image

kanjisan
112
accept rate: 0%

edited 26 Sep '14, 12:03

Hi Kanjisan

I don't know much about DFS, but given that \server-name\share worked (because PA File Sight was installed on server-name), but the new \domain-name\share doesn't, something must be working differently at the network/file system level.

When a user requests a file from \domain\share, some system somewhere is satisfying that request (since the file isn't actually on the domain server). I don't know which server (this is where my DFS knowledge fails me), but I'll bet that whichever server is responding to the user sees the username, and then forwards the request to DFS as user NT AUTHORITY, which is what PA File Sight sees. So PA File Sight might need to be installed on the server that is initially responding to the user.

link

answered 26 Sep '14, 17:34

Doug's gravatar image

Doug ♦♦
10.1k112037
accept rate: 21%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×18
×2

Asked: 24 Sep '14, 13:55

Seen: 3,672 times

Last updated: 26 Sep '14, 17:34