Overview

Purpose of this guide

This guide explains how to configure ADAudit Plus for File Integrity Monitoring (FIM). FIM helps you track changes to critical system files, program files, and configuration folders across your Windows servers, domain controllers, and workstations. Follow this workflow before relying on FIM reports:

1. Add the domain and select computers for FIM in ADAudit Plus.
2. Add the files and folders to monitor.
3. Configure the required audit policies on monitored computers.
4. Configure object-level auditing (SACL) on the files and folders you want to monitor.
5. Configure exclusions to reduce noise where required.
6. Configure Security event log size and retention.
7. Verify that expected file integrity events are generated and collected.

What is File Integrity Monitoring

File Integrity Monitoring tracks changes to files and folders that are critical to the normal functioning of an operating system or application. By monitoring creation, modification, deletion, move, rename, permission changes, and owner changes, FIM helps detect unauthorized changes and potential malware activity.

ADAudit Plus collects FIM events from the Windows Security event log on monitored computers and presents them in reports and dashboards.

Supported systems

Note Windows Server 2003 / 2003 R2 and Windows XP / Vista are Microsoft end-of-life. Legacy audit policy guidance is retained only for environments where these systems still exist. Plan to upgrade to a supported operating system.

Monitored file and folder activity

ADAudit Plus monitors the following file and folder activity for FIM: