A little help please

[Merlin775]

I am wondering how to find the internet browsing history of users through my network? I am currently running Windows Server 2000. I have searched through the Microsoft knowledge base, the How To section and through our forums here. If I have just missed it I would appreciate the query to search for. I may well have just not used the correct keywords in my search.

Is there a log of user activity in my server? If so then where is it located?

Thanks for tolerating the N00b.

Merlin775

[morganlefay]

I think you may need ISA??

Do you have that installed?

How is your server\network connected to the internet??

MLF

[jbclarkman]

what does your network log? I know here where I work they use a version of Retina and sometype of groupwise or intrusheild to track what we do.

[Ghost_25inf]

Yes tell us what type of network you have (Domain or workgroup) If you have a domain and you are the admin you are able to connect to each users machine and check there history folder but there is also a more easier way, Install a proxy server so you can monitor the activity or check the Router or gateway log files. There is also a snap-in I believe that can be set within active directory to where you can monitor everyones activity. Research: Using Active Directory and Setting up a Proxy Server.

[SirDice]

I don't know where you live but in my country it is illegal to view that information (privacy issues). Only our Security Officer is able to view that information if and only if there is a reason to do so (if that perticular user is accused of abuse i.e.).

Check your local laws!

[MrLinus]

I don't know where you live but in my country it is illegal to view that information (privacy issues). Only our Security Officer is able to view that information if and only if there is a reason to do so (if that perticular user is accused of abuse i.e.).

Wow. Very stringent privacy laws then where you are. I always thought that if the Security policy was worded to inform users that there is no expectation of privacy (ie., their activity may be monitored from time to time) then it was ok. I would imagine this is particularly true for the original author of the thread since he seems to indicate he's from Indiana (USA) where individual privacy has sorta been tossed out of the window.

That all said, if there is no security policy things could potentially get dicey if information gathered in a monitoring of employees is used to terminate their employment and they take the company to court (doesn't mean it'll be tossed but the judge will probably consider this factor). So you may want to check if your company has a security policy and/or an acceptable use policy for employees that outlines what employees are allowed to do with resources provided by the company and what the company may do to protect/monitor those resources. (Ye ol' CYA).

Monitoring can be done by a variety of methods and it's best to use multiple options:

• - proxy
  - firewall
  - packet sniffer
  - web caching
  - web blocking software (while this has limited success, the company may deem that certain sites are off-limits)
  - IDS
  - manual methods (going through individual browser history files)

The actual tool that you use depends on your comfort-level and what is "acceptable" as far as applications/software for your company. Certainly linux applications can be used for these as can various Windows apps (first one that comes to mind is ISA -- sort of an "all-in-one"). Of course, all-in-ones do have drawbacks as do individual products (say if you used a box for IDS, one for a firewall, one for packet sniffing, etc.).

[Merlin775]

I wanted to thank all of you for responding. What is happening is that I have been given the actual title of IT Admin in the shop. We do have a security policy and a company resources usage policy but so far those have not been enforced. I have been asked to gather more information on how to do the logging which is why I was searching.

We have a network with a domain. I do not believe that we have ISA turned on and to my knowledge there are no other services running that should be logging user activity. I just wanted to be sure that I had not missed something obvious before telling managment that those things are not being used. I will need to check my firewall but I don't believe I am logging outbound traffic. I don't actually want to log the users, I just want to be able to answer correctly when I say we do or don't have the logs.

I am now going to go look up ISA and IDS.

Thanks again.

Merlin775

[SirDice]

Originally posted here by MsMittens
Wow. Very stringent privacy laws then where you are.

Hehehe. The Dutch take their privacy very seriously