Overview

Purpose of this guide

This guide explains how to configure ADAudit Plus for File Integrity Monitoring (FIM). FIM helps you track changes to critical system files, program files, and configuration folders across your Windows servers, domain controllers, and workstations. Follow this workflow before relying on FIM reports:

1. Add the domain and select computers for FIM in ADAudit Plus.
2. Add the files and folders to monitor.
3. Configure the required audit policies on monitored computers.
4. Configure object-level auditing (SACL) on the files and folders you want to monitor.
5. Configure exclusions to reduce noise where required.
6. Configure Security event log size and retention.
7. Verify that expected file integrity events are generated and collected.

What is File Integrity Monitoring

File Integrity Monitoring tracks changes to files and folders that are critical to the normal functioning of an operating system or application. By monitoring creation, modification, deletion, move, rename, permission changes, and owner changes, FIM helps detect unauthorized changes and potential malware activity.

ADAudit Plus collects FIM events from the Windows Security event log on monitored computers and presents them in reports and dashboards.

Supported systems

Category	Supported versions
Windows Server	Windows Server 2003 / 2003 R2, 2008 / 2008 R2, 2012 / 2012 R2, 2016, 2019, 2022
Workstations	Windows XP, Vista, 7, 8, 10, 11

Note: Windows Server 2003 / 2003 R2 and Windows XP / Vista are Microsoft end-of-life. Legacy audit policy guidance is retained only for environments where these systems still exist. Plan to upgrade to a supported operating system.

Monitored file and folder activity

ADAudit Plus monitors the following file and folder activity for FIM:

Activity	Description
Create	New files or folders are created.
Modify	Existing files or folders are modified.
Delete	Files or folders are deleted.
Move	Files or folders are moved.
Rename	Files or folders are renamed.
Permission changes	Access control lists (ACLs) or SACLs are changed.
Audit setting changes	System access control list (SACL) settings are changed.
Owner changes	The owner of a file or folder is changed.
Copy and paste	Files or folders are copied and pasted.
Failed write attempts	Unauthorized attempts to write to a file or folder.
Failed delete attempts	Unauthorized attempts to delete a file or folder.