How to audit a folder in Windows

When networking shared resources, you should audit the individual folders you are sharing out.  This allows you to ‘see’ who is using the folders and how files are being manipulated.

How to Audit User Access of Files, Folders, and Printers

The audit log appears in the Security log in Event Viewer. To enable logging:

  1. Click Start, go to the Control Panel, click on Performance and Maintenance, and  click Administrative Tools.
  2. Open the Local Security Policy.
  3. In the left pane, double-click Local Policies.
  4. Click Audit Policy to display the individual policy settings.
  5. Click Audit object access.
  6. Select the Success check box on items you would like to monitor.
  7. Select the Failure check box on items you would like to monitor.
  8. You can select both check boxes to audit Success and Failures.
  9. Click OK.

How to Specify Files, Folders, and Printers to Audit

Once you enable auditing, you can specify the files, folders, or printers that you want audited. :

  1. Locate the file or folder you want to audit. To audit a printer, locate it by clicking Start, and  clicking Printers and Faxes.
  2. Right-click the file, folder, or printer you want to monitor (audit) , click Properties.
  3. Click on the Security tab, and  click the advanced button.
  4. Click on the Auditing tab, and  click on add.
  5. Clicking Advanced, and  click Find Now -navigate to the person or group you would like to audit.
  6. Click OK.
  7. Select the Successful or Failed check boxes (select the ones you want)click OK.
  8. Click OK,  click OK.
You can now look under the Event Viewer and ‘see’ what users are doing.
Remember when creating a VPN or sharing a folder- you always want to audit a folder or file.
About these ads

2 comments on “How to audit a folder in Windows

  1. Hi friends,

    This is a great blog. Thanks for all your hard work and the info you give.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s