As per Spiceworks Virtualization Trends for 2016, Windows Server 2012 has been one of the most widely deployed servers around the globe for supporting collaborative work environments. Because of the intrinsic nature of these kinds of environments, where multiple users have access to the same resources, fixing responsibility for user actions becomes very important.
Thus, it is important to audit all user actions concerning files and folders access. In this article, the process of enabling files and folders auditing on Windows Server 2012 has been explained.
On Windows Server 2012, auditing file and folder accesses consists of two parts:
- Enable File and Folder auditing which can be done in two ways:
- Through Group Policy (for Domains, Sites and Organizational Units)
- Local Security policy (for specific folder)
- Configure audit settings for File and Folders
This article will cover the process of enabling auditing for object access on a Windows Server 2012 through Group Policy.
1. Enable Auditing through Group Policy (for Domains, Sites and OUs)
To enable auditing through GPO, follow these steps:
- Go to “Start” ➔ “Control Panel”. In this window, double-click “Administrative Tools”, and then double-click “Group Policy Management” console to open it.
- Go to the concerned domain and expand it as shown in the following figure.
- Right-click “Group Policy Objects, and click “New”.
- In “New GPO” dialog box, enter the name of new GPO and click “OK”.
- Right-click the newly created GPO and click “Edit” to open “Group Policy Management Editor” window.
- In “Group Policy Management Editor”, go to “Computer Configuration” ➔ “Policies” ➔ “Windows Settings” ➔ “Local Policies”.
- Select “Audit Policies” to view all of its policies in the right panel.
- Double-click “Audit Object Access” to access its properties
- Click “Define these Policy Settings” to check its box.
- Check both “Success” and “Failure” boxes.
- Click “Apply” and “OK”.
- Execute the following command at “Run” or “Command Prompt” to apply this policy on the domain controller.
After the policy has been applied, you can configure audit settings for File and Folders.
2. Enable Auditing of Specific Folder
To select specific folders and define users, follow these steps.
- Select the folder that you want to audit.
- Right-click and click “Properties” to access its properties.
- Go to “Security” tab, and click “Advanced”.
- In “Advanced Security Settings…” dialog box, select “Auditing” tab.
- Click “Add”. “Auditing Entry for…” window appears on the screen.
- Click “Select a principal” link. It shows “Select User…” dialog box.
- Type the name of that user, of which access you want to monitor. Click “Check Names” button to validate its entry. You can repeat this step to provide the names of all users, whose access to the selected folder have to monitored. Alternatively, you can type “Everyone” to monitor every users’ accesses to this folder.
- Click “OK” once you have made your selection of users. It takes you back to “Auditing Entry” window.
- Select “Both” in “Type” drop-down menu to monitor both “Success” and “Fail” accesses made to the folder.
- In “Applies to” drop-down menu, select “This folder, subfolders, and files”.
- Select “Full Control” or the appropriate permissions for auditing. It is advised to click “Show Advanced Permissions” and select all permissions.
- You can use “Add a condition” link at the bottom to limit the scope of this auditing entry. You can add multiple conditions, if required. This way the auditing will generate limited logs.
- Click “OK” to save the settings and close “Auditing Entry for …” window.
- Click “Apply” and “OK” to close “Advanced Security Settings for” window.
- Click “OK” to close the folder properties.
View the Record in Event Viewer
After auditing has been enabled, the logged events can be viewed in Event Viewer. The following image shows the logged event for a file access.
How Lepide File Server Auditor helps with File and Folder Access Auditing
The Lepide File Server Auditor enables you to easily track any modifications being made to File Server, including files and folders themselves. You can track file copy events, file read attempts, file modifications, moves, creations, deletions and more with just the click of a button. You can also track whenever users attempt to read files (both successfully and failed attempts).
These reports take seconds to generate and provide all the critical file server auditing information that you need to detect potential threats or unwanted changes being made.
In this article, we have gone through the native process for configuring file and folder auditing. We have also shown you how much better our Lepide File Server Auditor (part of Lepide Data Security Platform) is at doing the same job. Given the importance of security and compliance, it obvious that a specialized solution like Lepide’s File Server auditing software should be given preference over native auditing.