Auditing

[JJADAMS]

Hi all, I have several machines that end up with a couple of files in the C:root of windows NT 4.0. Is there anyway to audit the PC to see where the files are being created at? Or to see if a particular application is putting them there? Thanks for all your help.

 

[CTho9305]

sysinternals filemon show you what programs access what files when... have you googled the filenames?

 

[JJADAMS]

I have with no return back on what I'm looking for. Thanks