Configuring object level auditing - Using PowerShell cmdlets

To audit file and folder access, object-level auditing must be enabled. This can be achieved in three ways:

• Using Windows shares
• Using PowerShell cmdlets
• Using Global Object Access Auditing

Using PowerShell cmdlets

• Create a CSV file that lists the Universal Naming Convention (UNC) paths or local paths of all files and folders for which you want to enable File Server Auditing (FIM).
• The CSV file should list the files/folders in the following format: <file/folder>,FIM

Example:

E:\test folder,FIM

\\SERVERNAME\c$\folder,FIM

E:\test file.txt,FIM

Once you have the CSV file ready with all the required paths, open PowerShell and navigate to the <Installation Directory>\bin folder.

Type in:

.\ADAP-Set-SACL.ps1 -file '.\file name' -mode add (or) remove -recurse true (or) false -username DOMAIN_NAME\username

Where:

Note: When removing object-level auditing for a set of files or folders, the <type> parameter 'FIM' is not mandatory.

For example

• To set object-level auditing for the list of folders in a CSV file named folders.CSV, use:
  .\ADAP-Set-SACL.ps1 -file '.\folders.CSV' -mode add
• To replace all subfolder object-level auditing settings with inheritable auditing settings applied to a CSV file named folders.CSV, use:
  .\ADAP-Set-SACL.ps1 -file '.\folders.CSV' -mode add -recurse true
• To remove object-level auditing for the list of folders in a CSV file named folders.CSV, use:
  .\ADAP-Set-SACL.ps1 -file '.\folders.CSV' -mode remove