Active Directory How-To pages

Active Directory Auditing Tool

The Who, Where and When information is very important for an administrator to have complete knowledge of all activities that occur on his Active Directory. This helps him identify any desired / undesired activity happening. ADAudit Plus assists an administrator with this information in the form of reports. In real-time, ensure critical resources in the network like the Domain Controllers are audited, monitored and reported with the entire information on AD objects - Users, Groups, GPO, Computer, OU, DNS, AD Schema and Configuration changes with 200+ detailed event specific GUI reports and email alerts.

Account Management » Active Directory How-To pages

How to find out who changed the Folder permissions?

  1. Navigate to the required file share, right-click it and select "Properties" Select the "Security" tab → "Advanced" button → "Auditing" tab → Click "Add" button:
    • Select Principal: "Everyone"; Select Type: "All"; Select Applies to: "This folder, sub-folders and files".
    • Select the following "Advanced Permissions": "Change permissions and "Take ownership".
  2. Run gpmc.msc → Edit "Default Domain Policy" → Computer Configuration → Policies → Windows Settings → Security Settings.
  3. Go to Local Policies → Audit Policy:
    • Audit object access → Define → Success and Failures.
  4. Go to "Advanced Audit Policy Configuration" → Audit Policies → Object Access:
    • Audit File System → Define → Success and Failures
    • Audit Handle Manipulation → Define → Success and Failures.
  5. Go to Event Log → Define:
    • Maximum security log size to 1gb
    • Retention method for security log to 'Overwrite events as needed'.
  6. Open Event viewer and search Security log for event id 4663 with "File Server" or "Removable Storage" task category and with "Accesses: WRITE_OWNER" string. "Subject Security ID" will show you who changed the file’s/folder's owner or the permissions on this folder/file.


Native auditing becoming a little too much?

Simplify file server auditing and reporting with ADAudit Plus.

Learn More »

Explore Active Directory auditing and reporting with ADAudit Plus.

  • Enter your email id
    Please enter a valid email id
  • Enter your phone number
  • Select demo date
  • By clicking 'Schedule a personalized demo', you agree to processing of personal data according to the Privacy Policy. You can unsubscribe from our mails at anytime.
Account Management Auditing
Active Directory Auditing
Windows Server Auditing