Overview

Purpose of this guide

This guide explains how to configure ADAudit Plus for Windows File Server auditing. Follow this setup workflow before relying on File Audit reports for audit, investigation, or compliance reviews:

• Add Windows File Servers and shares in ADAudit Plus.
• Configure the required audit policies on monitored File Servers.
• Configure object-level auditing (SACL) on audited files and folders.
• Configure Security event log retention and size.
• Configure exclusions where required to reduce noise.
• Verify that expected file activity events are generated and collected.

Note This guide is focused on Windows File Server auditing. File integrity monitoring (FIM) is handled separately and is not covered here.

What ADAudit Plus audits on Windows File Servers

ADAudit Plus helps audit access and changes to shares, files, and folders on Windows File Servers, including standalone servers, configured shares, and Windows failover cluster environments.

With ADAudit Plus, you can:

• Track access and changes to shares, files, and folders.
• Identify the username, workstation, and IP address associated with file activity.
• Audit file and folder creation, deletion, modification, read, move, rename, owner changes, permission changes, and audit setting changes.
• Track failed read, write, and delete attempts.
• Receive alerts for suspicious or high-risk file activity.
• Audit Windows failover clusters for highly available file server environments.
• Automate review through scheduled reports.
• Support compliance requirements such as SOX, HIPAA, the PCI DSS, and the GLBA.

Supported systems and storage scope

Note Files and folders can both be audited. Configure object-level auditing on the specific shares, folders, and files that must generate audit events.