How to identify a user's action

Question

My network contains multiple users and I need to identify the user who created a certain folder and the other one who deleted a file. How can I find out?&nbsp;

capaz · Answer

The system does not&nbsp;log&nbsp;that sort of user activity.&nbsp;Edit: &nbsp;If this is an ongoing need (vs. forensics on something that has already been done), here a solution that worked for one user:https://community.netgear.com/t5/ReadyNAS-in-Business/ReadyNAS-316-User-actions-monitoring-for-Insider-Threat/m-p/1173155&nbsp;

Sandshark · Answer

Wouldn't the user who created a folder be the owner of that folder? Not something you can see from the GUI, but certainly visible via SSH.

Once a file is gone, I can't think of any way to figure out who deleted it.

capaz · Answer

Sandshark wrote:Wouldn't the user who created a folder be the owner of that folder?&nbsp; Not&nbsp;something you can&nbsp;see from the GUI, but certainly visible&nbsp;via SSH.&nbsp;Once a file is gone, I can't think of any way to figure out who deleted it.&nbsp;Ok, you went there. &nbsp;:-)I had composed the following, and then held&nbsp;off posting for fear of opening a proverbial can of worms.&nbsp;Depending on how critical is your need, it might be technically possible&nbsp;to&nbsp;figure out who created a particular folder, but only if things have been configured and used in a particular way:&nbsp;If your users are connecting to the share using individual ReadyNAS user account credentials (i.e., not anonymous/guest) then a folder will be owned by the particular ReadyNAS user that created it. &nbsp;Because that ownership is at the underlying filesystem level, the only way (AFAIK) to determine that ownership is using SSH shell access. &nbsp;This generally requires some level of comfort/experience with the underlying linux OS. &nbsp;There is info on configuring ReadyNAS SSH access here:https://kb.netgear.com/30068/ReadyNAS-OS-6-SSH-access-support-and-configuration-guidesNote the very serious caveats in&nbsp;that article, along with this warning from the ReadyNAS OS user manual:&nbsp;WARNING:If you enable SSH root access, NETGEAR might deny you technical support.

jak0lantash · Answer

Download the logs from the GUI, and look at smbd.log.Check the owner of the files.If that doesn't bring answers, there is nothing more that you can on a ReadyNAS, afaik anyway.

capaz · Answer

Holy cow! &nbsp;I couldn't resist poking at this some more, and found&nbsp;the following:&nbsp;On a Windows (10) client computer, mounting&nbsp;a SMB share using ReadyNAS user credentials, I was able to determine the owner by:In File Explorer, select the folder and do right-click -&gt; PropertiesIn the Properties window, click the Security tab(wait for spinner mouse pointer to finish)Click on the Advanced button...and presto:&nbsp;&nbsp;and on another folder:&nbsp;&nbsp;I don't know what, if anything, particular to my configuration might be enabling this. &nbsp;After thinking about it a bit, it just seems like Samba is doing a pretty good job of mapping the underlying Linux ownership/permissions to Windows NTFS-style.&nbsp;I was not able to get &nbsp;the same kind of info on a Mac connected to the SMB share.&nbsp;BrenoMachad0,&nbsp;maybe worth a try?&nbsp;

Forum Discussion

How to identify a user's action

6 Replies

Related Content

ORBI RBRE 970 UN IDENTIFY NETWORK

NETGEAR Community User Guidelines

RAX70 identify individual devices

identifying devices on my netwrok

ReadyNAS 316 - User actions monitoring (for Insider Threat requirement)

NETGEAR Academy

ProSupport for Business