Answer the question
In order to leave comments, you need to log in
Answer the question
In order to leave comments, you need to log in
What processes were started - you need to configure the Data collectors set, I think you can configure it to write all running processes + e-mail notifications. By the way, I'm not sure if DCS is in the client OS, I'm working with server Windows.
I won't tell you what programs were opened, but you can think and come up with a workaround.
Which folders were opened - everything is very simple here, if this is a PRO version, in group policies enable auditing for Object Access in Success and Failure, then on the necessary folders on the Security tab, click Advanced and on the Auditing tab enable auditing for everyone. A record of access to the folder will be poured into the event viewer - security log, where you can also configure e-mail notifications
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question