How to Enable File Auditing on Windows Server

Step 1: Enable an audit policy

First, enable auditing at the system level. Choose one of the following methods. Audit File System is recommended for new configurations, while Audit Object Access is an alternative for environments that use Basic Audit Policy. Do not enable both methods.

Method 1: Enable Audit File System using Advanced Audit Policy

1. Open Server Manager and select Tools -> Group Policy Management. Alternatively, run gpmc.msc
2. Expand Forest -> Domains -> your domain.
3. Locate the organizational unit containing the target file servers.
4. Right-click the OU and select Create a GPO in this domain, and Link it here.
5. Enter a name for the GPO, such as File Server Auditing Policy, and select OK.
6. Right-click the new GPO and select Edit.
7. Navigate to: Computer Configuration – Policies – Windows Settings – Security Settings – Advanced Audit Policy Configuration – Audit Policies – Object Access
8. Double-click Audit File System.
   
9. Select Configure the following audit events.
10. Select Success, Failure, or both:
    • Success records permitted operations.
    • Failure records denied access attempts.
11. Select Apply, and then select OK.
12. On the target file server, wait for Group Policy to refresh or run the following command from an elevated Command Prompt:
    gpupdate /force
13. Verify the effective policy:
    auditpol /get /subcategory:”File System”

Method 2: Enable Audit Object Access using Basic Audit Policy

Use this method only as an alternative to Audit File System.

1. Open Group Policy Management.
2. Expand Forest – Domains – your domain.
3. Locate the OU containing the target file servers.
4. Right-click the OU and select Create a GPO in this domain, and Link it here.
5. Enter a name for the GPO and select OK.
6. Right-click the new GPO and select Edit.
7. Navigate to: Computer Configuration – Policies – Windows Settings – Security Settings – Local Policies – Audit Policy
8. Double-click Audit object access.
9. Select Define these policy settings.
10. Select Success, Failure, or both.
11. Select Apply, and then select OK.
12. On the target file server, wait for Group Policy to refresh or run:
    gpupdate /force
13. Verify the effective policy:
    auditpol /get /category:”Object Access”

Step 2: Configure auditing for a specific file or folder

Next, configure an auditing entry on each file or folder that you want to monitor. This entry defines the users, access types, permissions, and—in the case of a folder, the inheritance scope to audit.

Enable auditing for a specific file

1. 1. Right-click the file that you want to audit and select Properties.
   2. Open the Security tab and select Advanced.
   3. In Advanced Security Settings, open the Auditing tab.
   4. Select Add.
   5. Select Select a principal.
   6. Enter the user or security group whose access you want to monitor.
   7. Select Check Names, and then select OK.
      Note: To monitor additional users, create separate auditing entries or select an appropriate security group. Use Everyone only when access by every user must be monitored.
   8. From the Type list, select:
      • Success for successful access
      • Fail for unsuccessful access attempts
      • Both for both types of access
   9. If Applies to is displayed, select This file only or This object only.
   10. Select the permissions that you want to audit, such as: Read data, Write data, Delete, Change permissions, Take ownership
   11. Select OK to save the auditing entry.
   12. Select Apply, and then select OK to close Advanced Security Settings.
   13. Select OK to close the file’s Properties dialog box.

Note: Avoid selecting Full control, every permission, and both Success and Failure unless comprehensive auditing is required. Broad auditing can generate a large number of Security events.

Enable auditing for a folder

The same general steps can be used for a folder:

1. Right-click the folder and select Properties.
2. Navigate to Security – Advanced – Auditing.
3. Add the required user or group.
4. Select the access type and permissions to audit.
5. Use Applies to to specify whether auditing covers:
   • The selected folder only; or
   • The selected folder, its subfolders, and its files.

Search File auditing events in Event Viewer

After configuring auditing, perform a monitored action and search for the resulting events on the file server.

1. Open Event Viewer by running eventvwr.msc
2. Navigate to: Windows Logs – Security
3. In the Actions pane, select Filter Current Log.
4. In the Event IDs field, enter: 4656 or 4658 or 4660 or 4663 or 4670
5. Select OK.
6. Open an event and review. The following image shows the logged event for a file access.
   • Account Name: the user associated with the activity
   • Object Type: confirm that the value is ‘File’
   • Object Name: the file or folder path
   • Process Name: the application that requested access
   • Accesses: the access rights requested or used
   • Handle ID: an identifier used to correlate related events
7. To locate events for a particular file, select Find and enter the file name or part of its path.

Key Event IDs for File and Folder Auditing:

How Lepide Auditor helps with File and Folder Auditing

The Lepide File Server Auditor enables you to easily track any modifications being made to File Server, including files and folders themselves. You can track file copy events, file read attempts, file modifications, moves, creations, deletions and more with just the click of a button. You can also track whenever users attempt to read files (both successfully and failed attempts).

These reports take seconds to generate and provide all the critical file server auditing information that you need to detect potential threats or unwanted changes being made.

Native Auditing vs. Third-Party Solutions

Frequently Asked Questions