If it was one of the standard Windows file servers, and not a SMB/CIFS appliance, the audit controls are very-detailed and fine-grained from 7/2008 up. Previou

If it was one of the standard Windows file servers, and not a SMB/CIFS appliance, the audit controls are very-detailed and fine-grained from 7/2008 up. Previous audit controls were so. You need to modify which ones you want logged, and then you would need some central sink to log all the Event Log events on all the servers, and review those of interest. I have never worked in an area with that level of paranoia. However, if NSA contractors are put under the same Federal Desktop Core Configuration requirements [0] at a minimum, I would imagine the client and/or server (if he was required to use Windows) are known, or the NSA contractors are not in compliance. What they do with that information is another story. That said, any admin could change local policy settings, reboot with the computer, and reconnect it to the domain later. I got clever with such things to disable security policies like those when troubleshooting lab computers. We shall never know how smart/dumb Snowden was and they were. [0] http://usgcb.nist.gov/usgcb/microsoft_content.html http://usgcb.nist.gov/usgcb/microsoft_content.html