Can I see what a user copied to a drive?

[mike6623]

We have an employee who we believe may have backed up sensitive information to a personal flash drive.

We run Windows 7 professions on 2012 R2 server.

Is there a way that I can check to see what was copied to an external drive? If so, how?

 

[LMiller7]

I don't think there is any way to tell what was copied unless auditing was enabled for the files in question. File and Folder auditing is not enabled by default. This auditing must be very selective or it would consume a large amount of disk space in a short time. In the interests of security it would be best if the use of flash drives was prevented on the server and clients. I believe this can be done with Group Policy.

 

[mike6623]

Thanks, I was hoping there would be a log file somewhere with just what was copied, like My docs to (Hdrive) guess not!