How to check who last modified a file in Windows

In Active Directory (AD) environments, unauthorized or unplanned file changes can pose significant security and compliance risks. To check who last modified a file in Windows shall be performed with help of EventViewer, PowerShell commands and real-time auditing solutions like ADAudit Plus.

Following are the steps involved to track who modified a file or folder in a Windows server with EventViewer:

1. Tracking who last modified a file using Native Auditing

1.1 Enabling file auditing policies using GPMC.

In order to record the file activities performed in a Windows Server, file auditing policies have to be enabled using GPMC for domain joined-servers or using Local Security Policy for a local server.

The following are the steps involved to enable the auditing policies.

1.2 Adding Auditing (SACL) entries at file/folder level

SACL is a Windows security feature that is used to record attempts to access or modify objects such as files, folders, registry keys. Thus, in order to track who modified, SACL entries must be added at the file/folder level.

Below are the steps used to add a SACL entry:

1.3 How to check who last modified a file in EventViewer

Once the auditing policies and auditing entries are configured, the events created can be viewed in EventViewer.

Event ID 4663 - An attempt was made to access an object is generated when a particular operation is performed on an object like files/folder. This helps in identifying if file activities such as Read, Write, Delete, or Moved were performed. Using this event, we can derive:

• Account Name: The user who accessed or modified a file/folder.
• Object Name: The complete path of the file or folder.
• Accesses: The type of modification performed.
• Process Name: The program used to perform the modification.

Tracking EventID 4663 using Event Viewer

1. Open EventViewer or execute the command eventvwr.msc using Run command
2. On the right pane, navigate to Security > Filter current log
3. In the pop-window and under All Event IDs, enter 4663 to filter all its occurrences
4. Double-click on each occurrence and view its properties.

2. How to track who last modified a file/folder using PowerShell

Get-WinEvent is a PowerShell cmdlet that is used to retrieve event logs recorded. With the help of the "-FilterHashtable" parameter added to the cmdlet, event logs shall be filtered based on their properties such as Id, Log Name, Time created etc.

Below is a sample PowerShell command that retrieves the latest occurrence of EventID 4663 i.e, the latest modification performed to file/folder. The output provides the timestamp, username, domain, exact file/folder path, and the process used for modification.

$targetPath = "C:\Your\Target\Path"
Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4663
} -MaxEvents 1000 |
ForEach-Object {
    $xml = [xml]$_.ToXml()
    $data = $xml.Event.EventData.Data
    [PSCustomObject]@{
        TimeModified = $_.TimeCreated
        User        = ($data | Where-Object { $_.Name -eq 'SubjectUserName' }).'#text'
        Domain      = ($data | Where-Object { $_.Name -eq 'SubjectDomainName' }).'#text'
        ObjectName  = ($data | Where-Object { $_.Name -eq 'ObjectName' }).'#text'
        ProcessName = ($data | Where-Object { $_.Name -eq 'ProcessName' }).'#text'
    }
} |
Where-Object { $_.ObjectName -eq $targetPath } |
Sort-Object TimeModified -Descending |
Select-Object -First 1
        

Limitations of using native AD auditing or powershell commands

• Imminent risk of older logs getting overwritten after a period of time due to limited security size log.
• High alert noise since for every object access, Event ID 4663 is triggered.
• The auditing entries (SACL) must be added for every file/folder.
• Complexity of powershell queries increases when multiple files/folders are involved.
• Powershell commands have to be executed in the server where file/folder is present.

3. How to track who last modified a file/folder using ADAudit Plus

An auditing solution like ADAudit Plus offers built-in reports to track changes made to file/folders not from one server but from all the Windows servers configured. In ADAudit Plus, you'll find dedicated reports to track all file activities such as creation, deletion, modified etc. Each report provides information on:

• Who made the change
• What was the change
• When did the change

Follow the below steps to track who last modified a file in ADAudit Plus:

1. Open ADAudit Plus.
2. Navigate to File Audit > File Audit reports> Files Modified.
3. Click on Advanced Search, select the filter options "File/Folder name", "Is" and enter the name of the file/folder.
4. Click on Search to apply filter.
5. Using the column "Modified By" in the report, identify the list of users who have modified the specified file.

FAQ and Troubleshooting