File server permissions auditing tool

File server permissions auditing with ADAudit Plus

Know when file server permissions are changed across your Windows file servers and NAS devices.

File server permissions auditing tool

Permission drift rarely announces itself. A folder opens to a broader group due to inheritance changes, an audit policy disappears, or a folder changes ownership with no change request attached, and none of it generates a visible alert in native Windows tools. By the time someone investigates, the Security event log entry may have already rolled over.

ADAudit Plus gives you continuous visibility into every layer of file server permission activity. It captures DACL changes, SACL changes, folder ownership changes, failed access attempts, and all standard file operations across Windows file servers, NAS devices, and cloud file storage platforms, with each report entry showing the details such as the source user and machine.

What ADAudit Plus audits across your file server environment

ADAudit Plus covers every event type relevant to file server permissions and access, from the moment a permission changes to the moment someone fails to access a folder they should not be attempting to.

 

 

The Folder Permission Changes report shows file server name, folder path, user who made the change, modified time, and permission values for each DACL change event.

Track permission changes with before-and-after values

ADAudit Plus records the exact permission state before and after every folder permission change, including DACL, SACL, and ownership events. Each event includes the user who made the change, the machine it came from, and the timestamp.

• Old and new permission values are displayed in reports, giving you a complete before-and-after record for every change.
• Every SACL change is recorded with who made it and when, so audit gaps are visible as soon as they are created.
• Folder ownership transfers are captured with the previous owner and the new owner, with the full event context.
• Both SACL and ownership event types appear alongside DACL changes in the same file server audit view.

 

 

You can track what ACLs have been changed by using the Old and New ACL details in the permission change reports.

Monitor privileged user activity on file servers

Privileged accounts generate a disproportionate share of file server permission changes. ADAudit Plus captures all file server activity attributed to privileged accounts, including permission changes, file accesses, and failed access attempts. ADAudit Plus can:

• Record permission changes made by Domain Admin accounts.
• Show service account file activity alongside interactive user activity, with no separate audit stream.
• Filter any file audit report by user to isolate the activity of a single account across your entire file server environment.

Detect failed access attempts and anomalous file activity

Failed file access attempts are one of the clearest early signals of unauthorized access. A user repeatedly failing to read a file they do not have permission to open, or a service account suddenly generating denied write attempts on a share it has never touched, are patterns worth investigating.

ADAudit Plus records every failed read, write, and delete attempt with the user, machine, file path, and access type. Beyond static failure tracking, the UBA engine establishes a baseline of normal file activity per user and flags deviations from that baseline. This enables you to detect:

• When failed file access attempts spike above a user's normal volume.
• When file modification volume exceeds a user's baseline, which is a strong indicator of ransomware encryption activity.
• Unusual file deletion volumes are flagged separately, distinguishing bulk deletion from normal file management.
• File activity occurring outside a user's established working hours is reported as a time-based anomaly, independent of volume thresholds.
• First-time access to a file server resource by a user who has never accessed it before is recorded as a lateral movement signal.

 

 

The user behavior analytics capability built into ADAudit Plus detects abnormal spikes in failed access attempts to files.

Get real-time alerts on critical permission changes

Audit reports tell you what happened. Alerts tell you what is happening right now, while there is still time to act. ADAudit Plus comes with pre-configured alert profiles for the file server and permission change events that carry the highest risk, and you can configure additional profiles for any event combination relevant to your environment. Alert thresholds and scope are configurable, so high-volume environments only escalate changes on the shares and users that actually require immediate attention. You can configure alerts for:

• When a folder permission change occurs on a monitored share, your team is notified immediately, so unauthorized access grants are caught before users discover them.
• DACL changes, giving you a real-time notification with the user, machine, old permission value, and new permission value.
• AdminSDHolder Permission Changes to be aware the moment that object is modified, before the automatic propagation reaches the protected accounts.
• Possible Ransomware activity, when file modification and deletion patterns match ransomware behavior, giving your team a window to isolate the affected machine before encryption spreads.
• Auto-creating a ticket in ServiceNow, Jira, or ManageEngine ServiceDesk Plus, for high-priority events so the right team is notified without manual triage.

 

 

ADAudit Plus comes with prepackaged alert profiles for critical events like possible ransomware activity, AdminSDHolder permission changes, and so on.

 

 

You can also customize file server alerts for your organization's unique needs.

Meet compliance requirements for file server access

Compliance frameworks that touch file server environments require a complete, attributable audit trail for file access and permission change events. ADAudit Plus includes pre-configured compliance reports for every major standard, plus custom report profiles for audit cycles that require specific scoped views.

You can create custom report profiles that combine specific users, audit actions, time windows, and file paths into a saved view that generates on demand across audit cycles.

 

 

Easily generate reports for compliance audits, including ones for file server changes, user attribute changes, and so on.

Extend file permissions auditing to hybrid storage environments

Most file server environments now include Amazon FSx volumes and Azure File Share instances alongside on-premises servers, with user accounts that are hybrid identities authenticated through both on-premises Active Directory and Microsoft Entra ID. ADAudit Plus audits these platforms with consistent report coverage from a single console:

Windows file server and failover cluster, NetApp, EMC and EMC Isilon, Hitachi NAS, Huawei OceanStor, Synology NAS, Amazon FSx, QNAP NAS, Azure File Share, CTERA, Nutanix Files, and Qumulo NAS.

Why native tools fall short on file server permissions auditing

Windows records permission change events but the native infrastructure for working with those events has real limitations for any organization auditing file server permissions at scale.

• Security event logs are stored locally on each file server. There is no built-in mechanism to aggregate events across multiple servers, so investigating a permission change that spans several shares means logging into each server individually.
• Event Viewer has no alerting capability. You can view events after the fact, but there is no native path from a permission change event to a notification sent to the responsible team.
• The Security log has a fixed maximum size and overwrites the oldest events when it fills. In high-volume file server environments, events from earlier in the week may no longer exist by the time someone investigates.
• PowerShell can query event logs programmatically, but building and maintaining scripts for permission change tracking, before-and-after value extraction, and multi-server aggregation requires ongoing effort and produces no built-in audit trail of its own.

ADAudit Plus collects events from all monitored file servers centrally, retains them for the duration required by your compliance policy, and surfaces them in pre-configured reports with old and new permission values, with no scripting or manual log collection required.