You can try to use Windows Auditing like Scott suggests, but it's a mess and usually results with gobs of noise in the security log.
My company sells a file auditing product for Windows (and PCI) and if this is a short-term problem, you might be able to get away with just using the trial. You can get the 21 day trial here: http://www.bystorm.com/products-filesure-windows.html. HTH On Tuesday, November 20, 2012 8:51:50 AM UTC-6, stones2125 wrote: > > I am new to OSSEC and have been trying to figure out how to do the > following...if possible. > > - When a file changes on a Windows server, how do I see the username of > the person who changed it. > - How do I see the actual changes (lines of text) > > I get the alert that shows the file checksum changed, but need more info. >
