How to audit shared folder access changes?

It's mandatory to track all accesses to a file/folder that has sensitive data, to fulfil compliance requirements and ensure data security. Tracking user access for shared folders also gives admins a better leverage during investigations on attacks and attack attempts. Here is how you can audit user accesses on shared folder stored in file servers using native auditing methods.

Download for FREE Free, fully functional 30-day trial
  • With Native AD Auditing

  • With ADAudit Plus

Comprehensive reports to track file/folder access with ADAudit Plus

ADAudit Plus is an IT security and compliance solution that provides comprehensive reports to consolidate all the information you need about attempts made to access files or folders in your file servers. These reports can be exported and also scheduled to be automatically generated, at the specified times, and delivered to your inbox. You can also configure alerts to notify you when access requests are made on critical files/folders. This way you can take action immediately. Here is how you can access these reports using ADAudit Plus:

Launch ADAudit Plus and log in → Go to File Audit tab → Navigate to File Audit Reports and select File Read Access.

  • file access report
    • The details you will find in this report are:
      1. Which file was accessed
      2. Who accessed the file
      3. When the file was accessed
      4. Which client machine was the file accessed from
      5. Name of the server in which the file is stored
    You can also pull up the failed attempts to read, write, or delete a file. The reports contain the following details:
    1. Name of the file
    2. Name of the user whose request had failed
    3. Time at which handle request was madName of the server in which the file is located
    With a record of all attempts made to access a file (including failed ones), investigations in case of a data breach becomes much easier. You can track down all the users who accessed a file in order to detect possible unauthorized accesses. It can also help identifying the client machine from which failed attempts were made, thus detecting a compromised system.

Native method

  • Step 1: Enable 'Audit object access' policy
  • Launch the Group Policy Management console (Run --> gpedit.msc)

  • Create a new GPO and link it to the domain containing the file server or edit the existing GPO that is linked to the relevant domain.

  • Navigate to Computer Configuration -> Windows Settings -> Security Settings ->Local Policies -> Audit Policy.

  • Under Audit Policy, select 'Audit object access' and turn auditing on for both success and failure.

  • Navigate to Advanced Audit Policy Configuration -> Audit Policies-> Object access. Turn on auditing for 'Audit file system' and 'Audit handle manipulation'.

  • Step 2: Edit auditing entry in the respective file/folder

    Locate the file or folder for which you wish to track all the accesses. Right click on it and go to Properties. Under the Security tab click Advanced.

  • In Advanced Security Settings, go to the Auditin tab and click Add to add a new auditing entry.

  • In the Auditing Entry for Active Directory dialog box, enter the following details:

    1. Principal: Enter the names of the users whose access you wish to audit.
    2. Type: Select the type of access you want to audit. It is preferable to audit "All" changes.
    3. Applies to: Select whether you want to audit access only on this file, or on all sub folders and files.
    4. Basic permissions: Choose the types of permissions you want to audit. Click the Advanced permissions button and choose “Traverse Folder/Execute File”, “List Folder/Read data”, “Read attributes”, and “Read extended attributes” .
  • Step 3: View audit logs in Event Viewer

    Every time a user accesses the selected file/folder, and changes the permission on it, an event log will be recorded in the Event Viewer. To view this audit log, go to the Event Viewer. Under Windows Logs, select Security. You can find all the audit logs in the middle pane as displayed below.

  • To filter the event logs to view just the logs about the file/folder permission changes, select Filter Current Log from the right pane. Simply search for the event ID 4656 and 4663 which indicate file/folder permission changes. You can see who accessed the file in “Account Name” field and access time in “Logged” field.

Native auditing becoming a little too much?

Simplify file server auditing and reporting with ADAudit Plus.

Get Your Free Trial Fully functional 30-day trial

Related How-tos

Request Support


One of our solution experts will get in touch with you shortly.

    Please enter business email address
  • By clicking 'Send Request', you agree to processing of personal data according to the Privacy Policy.

© 2019 Zoho Corp. All rights reserved.