For an information security audit, we need to show if users copied or moved files from a particular location on our file server. As far as I know, if a user can read a file they can copy it and this action is not recorded in the security logs, same with moving a file.
Is there any record in the Event or security logs on Windows Server 2012 that records this, or do I need a 3rd party package to deal with this?
Best Answer
Not by default but you can enable auditing that will then log those actions to the event log.