What is a Distributed File System and how is it audited?

  

A Distributed File System (DFS) is a file system in which you can store and access files based on a client/server architecture. This system makes it easy for users to share files on a network in a controlled manner. Users can access the files as though it is stored in their local machines, but in reality, the servers control the data and determine who has access to it.

DFS Replication—A Windows Server role service

This multi-master replication engine ensures that files and folders are replicated across servers to provide a consistent experience for users connected on the network. DFS replication is achieved through an algorithm known as remote differential compression (RDC). The RDC identifies the changes made to files and replicates only the changes, rather than the entire file.

Why should you audit files in a DFS?

File auditing tells us who has access to what files, who accessed the files, the changes made to files in a DFS, and so on. It generates comprehensive reports on who viewed, deleted, or modified a file, and also alerts the IT team of an organization in case of a potential security breach. It shows identifiable factors like IP address, domain controller name, username etc. to pinpoint the source of an event.

DFS monitoring using ADAudit Plus

To access the DFS audit reports in ADAudit Plus:

For example, the screenshot below from ADAudit Plus shows a sample report on file modifications:

In this report, you can obtain information such as:

About ADAudit Plus

ADAudit Plus is a real-time Active Directory auditing tool that monitors all file servers including DFS. It offers 200+ reports and sends email alerts to the IT admin's inbox. It is a useful tool to understand employee behavior with regards to IT, and thwart insider and outsider attacks. It is also a valuable solution for companies that need to adhere to compliance mandates.