|
Hi, I have file sight ultra , and I added a local disk for watching activities. What I need is the username in our domain that trigger the monitored actions(delete,move or rename files or folder) but what i get for all actions is with the only user NT AUTHORITY for all my users actions. When I check the option for ignoring a user, I can see the list with all the correct users but they just not show in in the logs. could you please tell me how to fix this please? Regards |
|
Hi The drive that you added it accessible from the network without logging into the server where PA File Sight is monitoring? Also, how do the users access the documents on the drive? (log in to server, web access, etc.) Thanks Please make sure to mark your questions accepted when you have your answer by clicking the gray check mark to the left of the answer. |
|
The users login in their session with their AD account, then the login script map the share drive with the documents (the n: drive for our case). The documents are hosted in a DFS file servers that you need at least to be a domain user to access the files. The File sight is installed in this DFS server. Before we had a cluster of 2 file servers with a different path to access the documents, and our File sight was working perfectly by logging every username actions. The new servers are in DFS and use a different path to access the files, instead of our old \server-name share we have a path that looks like \domain-name share, beside to change the new path in the login script, nothing has been changed for users, and i reinstalled File Sight I kept the same configuration on the new server. Any idea ? |
|
Hi Kanjisan I don't know much about DFS, but given that \server-name\share worked (because PA File Sight was installed on server-name), but the new \domain-name\share doesn't, something must be working differently at the network/file system level. When a user requests a file from \domain\share, some system somewhere is satisfying that request (since the file isn't actually on the domain server). I don't know which server (this is where my DFS knowledge fails me), but I'll bet that whichever server is responding to the user sees the username, and then forwards the request to DFS as user NT AUTHORITY, which is what PA File Sight sees. So PA File Sight might need to be installed on the server that is initially responding to the user. |
