1. Track the last modified file in a directory using Native Auditing

To get the last modified file in a directory, file auditing policies must be enabled at the GPO level and at file/folder level. Once enabled, such file modifications are recorded as an event, which can be viewed using EventViewer.

1.1 Enable file auditing policies in GPMC

Follow the steps below to enable file auditing policies in the Group Policy Management Console (GPMC):

1. Execute gpmc.msc to launch the GPMC using the Run command.

   

2. Navigate to your desired domain.
3. Right-click Default Domain Policy or any group policy created within the Domain Controllers drop-down.
   Note:

   Creating a separate GPO makes it easier to troubleshoot, manage, and modify auditing configurations without affecting other domain-wide policies.

   

4. Select Edit, then navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy.
5. Under Audit Policy, double-click Audit object access to open its properties.
   Note:

   Audit object access is a specific audit subcategory. When enabled, it triggers Windows to start generating security log events, which are further collected by Event Viewer.

   

6. Select Apply and click OK to save the configuration.

1.2 Enable object-level auditing (SACLs) at the file or folder level

1. Open Windows Explorer and navigate to a file or folder from the preferred file share you want to audit.
2. Right-click the file or folder and select Properties.
3. Navigate to the Security tab and click Advanced to open the Advanced Security Settings window.

   

4. In the Advanced Security Settings window, select the Auditing tab which displays existing auditing entries.
5. Click Add to create a new auditing entry.

   

6. In the Auditing Entry dialog box, in the Principal field, select Everyone or specify the group or user by clicking Select a principal.
7. In the Type field, select All to audit both successful and failed events.
8. In the Applies to field, select This folder, subfolders and files.
9. Click Show advanced permissions, then select Write, Delete, or Create/write data.

   

1.3 How to track the last modified file in a directory with Event Viewer

Once auditing is configured, Windows records relevant file system activity through Event ID 4663. Event ID 4663- An attempt was made to access an object is generated when a particular operation is performed on an AD object such as file/folder. Tracking this eventID helps in identifying activities such as Read, Write, Delete or Moved. This eventID shall be tracked using the EventViewer.

1. Open Event Viewer.
2. Navigate to Windows Logs > Security.
3. Click Filter Current Log in the right pane under Actions. In the Filter Current Log dialog box that appears, enter 4663 under Includes/Excludes Event IDs.
4. Select the Find tab in the Actions menu, then enter the desired directory path and click Next.
5. Open the first event highlighted to view the details of the most recently modified file.

   

2. How to track the last modified file in a directory with PowerShell

The below PowerShell command sample returns the file name, last modification time, and file size of the most recently modified file.

Get-ChildItem -Path "C:\YourFolder" -File |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 1 |
 Select-Object Name, LastWriteTime, Length

3. How to track last modified file in a directory with ADAudit Plus

With the help of a centralized auditing solution like ADAudit Plus, administrators can monitor, investigate, and respond to file modifications more efficiently than native auditing and PowerShell methods.

To track the last modified a file in a directory with ADAudit Plus:

1. Open ADAudit Plus.
2. Navigate to File Audit > File Audit Reports. Each report under this category offers curated information, such as:
   • The user who performed the modification
   • The file and folder name along with the directory path
   • The time of the modification
   • The type of activity performed
3. Click Advanced Search, then enter the following:
   • Category: Location
   • Condition: Is
   • Value: Path of the directory/share (For example, \admin\adauditplus)
4. Select Apply to initiate the filtered search result and check the first entry to identify the last modified the specified file.

With Advanced Search in each report, a filtered search of all file activities across the environment can be performed at once. Through this feature, you can view a complete audit trail of files from a specific directory or by a specific date and time range.

Additionally, ADAudit Plus offers customized reports, scheduled reporting, and real-time notifications to alert when changes are performed on critical files.

4. Real-world use cases

Use case 1- Get the most recently modified file in a directory including subfolders.

The below PowerShell command retrieves the last modified file in a directory that has multiple subfolders. It returns the name of the file modified, last modified timestamp, length of the file after modification, and its relative path.

PowerShell command to get recently modified file in a directory with subfolders Copy

Get-ChildItem -Path "C:\YourFolder" -File -Recurse |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 1 |
 Select-Object Name, LastWriteTime, Length, DirectoryName

With ADAudit Plus

1. Open ADAudit Plus
2. Navigate to File Audit and open any of its reports.
3. Click Advanced Search, then enter the following:
   1. Category: Location
   2. Condition: Is
   3. Value: Path of the directory/share
4. Select Apply to initiate the filtered search result and check the first entry to identify the last modified the specified file.

2. To get the recently modified file of every subfolder in a directory.

PowerShell command to get recently modified file from every subfolder. Copy

$path = "C:\YourFolder"
Get-ChildItem -Path $path -Directory | ForEach-Object {
    Get-ChildItem -Path $_.FullName -File -Recurse |
        Sort-Object LastWriteTime -Descending |
        Select-Object -First 1 |
        Select-Object @{l='Folder';e={$_.DirectoryName}}, Name, LastWriteTime, Length
}

With ADAudit Plus

1. Open ADAudit Plus
2. Navigate to File Audit and open any of its reports.
3. Click Advanced Search, then enter the following:
   1. Category: Location
   2. Condition: Is
   3. Value: Path of the directory/share (For example, \admin\adauditplus)
4. Select Apply to initiate the filtered search result and check the first entry to identify the last modified the specified file.

3. To get the most recently modified file within a specific time range in a directory.

PowerShell command to get recently modified file in a directory in the last 24 hours. Copy

$path = "C:\YourFolder"
Get-ChildItem -Path $path -File -Recurse |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-1) } |
    Sort-Object LastWriteTime -Descending |
 Select-Object Name, LastWriteTime, Length, DirectoryName

Note:

Change AddDays(-1) to your required number of days. For example: Use AddDays(-7) to receive the most recently modified files from the last seven days or AddDays(-30) for the last 30 days.

With ADAudit Plus

1. Open ADAudit Plus
2. Navigate to File Audit and open any of its reports.
3. Select Period
4. From the dropdown options, select last 24 hours.
5. Click Advanced Search, then enter the following:
   1. Category: Location
   2. Condition: Is
   3. Value: Path of the directory/share (For example, \admin\adauditplus)
6. Select Apply to initiate the filtered search result and check the first entry to identify the last modified the specified file.