Active Directory How-To pages

How to check who last modified a file in Windows?

To know who viewed or modified a file, it is mandatory to have auditing enabled in the object that you wish to monitor, and also the server in which it is located.

Step 1- Enable auditing at server level

1. Start → Administrative tools → Local security policy snap-in
2. Expand Local policy → Audit policy
3. Go to Audit object access
4. Select Success/Failure (as needed).
5. Confirm your selections and click ok.

Step 2 - Enable auditing at object level

1. Navigate Windows Explorer to the file you want to monitor.
2. Right click on the target folder/file and select Properties.
3. Security → Advanced.
4. Select the auditing tab.
5. Click the ADD button.
6. Choose the users or groups you want to give audit permissions to.
7. In the Auditing Entry dialog box, select the types of access you want to audit. You have to select Success events separately from Failure events. Click OK when you are done.
8. Verify your selections and click APPLY.