File system auditor

File system auditing with ADAudit Plus

Track file access, changes, and deletions in your file systems

Every file operation on a monitored server generates an audit record in ADAudit Plus. Deletions, moves, renames, and copy-paste operations each have their own dedicated report.

• You can view aggregated reports on all file operations by processes so you can identify which applications account for the bulk of file activity on each server.
• Track every file deletion with the user, machine, and file path, giving you enough detail to answer an incident question in a single query.
• Capture successful read actions with the name of the process that opened the file.
• Failed access attempts are tracked separately for read, write, and delete operations, so patterns across multiple failed attempts against sensitive paths are visible without manual correlation.
• You can review everything a specific user or administrator has accessed within a time window to track down rogue activity.

 

 

Know who changed what in your file systems in real-time.

 

 

Track every file creation, modification, deletion, move and rename, copy and paste, permission change, and owner change event in your file systems.

Audit file and folder permission changes

ADAudit Plus captures every NTFS permission change with the old and new permission values. This means that:

• SACL modifications are tracked separately so you have a record if someone suppresses future audit events by changing audit settings on a path.
• Folder ownership transfers are also captured with details on who the ownership has been transferred from and to.
• Every DACL change records what the permissions were before and what they became
• Folder ownership changes are recorded with the previous owner and the new owner

 

 

Track file system permission changes with old and new ACL values.

 

 

Know when users are assigned higher permissions to files and check if it is required for their jobs.

Detect ransomware and anomalous file activity

Ransomware encrypts files by modifying them at high volume in a short window. Destructive attacks delete files in bulk. Both patterns look similar in raw event logs: a large number of file modification or deletion events from a single user account in a compressed timeframe.

Without a baseline, distinguishing a ransomware attack from a legitimate batch operation requires static event thresholds or manual investigation after the fact.

ADAudit Plus uses machine learning to establish a per-user baseline for normal file activity volume. When a user's modification or deletion count exceeds their learned threshold, the anomaly is flagged and an alert fires. Because the baseline is dynamic and unique, a user who normally processes large file batches is not flagged for doing so. The anomaly detection responds to deviations from each user's own pattern, not a domain-wide average. With this capability, you can detect:

• Users whose file modification count significantly exceeds their baseline, which is the primary signal for ransomware activity.
• Bulk deletion spikes, which can indicate ransomware activity, deliberate data destruction, or exfiltration followed by deletion.
• Spikes in denied access attempts, which can indicate an account trying to reach file paths it has no permission to access.
• File operations outside a user's normal working hours, relevant when account credentials are being used by an attacker in a different time zone

 

 

Set dynamic behavioral baselines for each user to know their usual activity volume and time, and know when deviations from this occur.

Get real-time alerts on critical file system events

ADAudit Plus ships with default alert profiles for the most critical file system events, and each profile is configurable to match your environment's specific thresholds and notification requirements.

• Alerts are delivered by email or SMS to the responsible team or individual stakeholder.
• You can configure automated responses to be executed when an alert is triggered.
• When integrated with a supported ITSM tool, a ticket is auto-created so the event enters your standard incident response workflow immediately.

Meet compliance requirements with file system audit reports

SOX, HIPAA, PCI-DSS, GDPR, FISMA, GLBA, and ISO 27001 each require organizations to demonstrate that access to sensitive data is controlled, changes are tracked, and audit records are retained and retrievable. ADAudit Plus includes pre-configured compliance report sets for all seven standards, plus custom profiles that combine specific users, file paths, operation types, and time filters into saved views. These can also be scheduled for automatic delivery at desired intervals.

Why native tools fall short on file system auditing

Windows Security Event logs record file access events locally on each server. This has several disadvantages:

• To investigate a file incident across multiple file servers, you retrieve logs from each machine separately. There is no native aggregation layer and no native alerting capability.
• A deletion that originated on one server and affected a file share mounted from another requires log queries on two different systems, with no built-in way to correlate the results.
• Security event logs on Windows file servers must be sized manually per server; overflows overwrite the oldest records, which creates compliance gaps when log retention is audited.
• Native auditing on NAS devices like NetApp, EMC, or Synology has no equivalent to Windows Event Viewer. Each vendor has its own log format, with no common interface for querying across platforms.
• Windows provides no native mechanism for process-level attribution in file events. You can see which user account performed an operation, but not which application or service initiated it.

ADAudit Plus aggregates file events from all monitored platforms into a single store, applies behavioral baselines to surface anomalies, and delivers real-time alerts with automated ITSM ticket creation.