Overview

Purpose of this guide

This guide explains how to configure ADAudit Plus for Windows File Server auditing. Follow this setup workflow before relying on File Audit reports for audit, investigation, or compliance reviews:

• Add Windows File Servers and shares in ADAudit Plus.
• Configure the required audit policies on monitored File Servers.
• Configure object-level auditing (SACL) on audited files and folders.
• Configure Security event log retention and size.
• Configure exclusions where required to reduce noise.
• Verify that expected file activity events are generated and collected.

Note: This guide is focused on Windows File Server auditing. File integrity monitoring (FIM) is handled separately and is not covered here.

What ADAudit Plus audits on Windows File Servers

ADAudit Plus helps audit access and changes to shares, files, and folders on Windows File Servers, including standalone servers, configured shares, and Windows failover cluster environments.

With ADAudit Plus, you can:

• Track access and changes to shares, files, and folders.
• Identify the username, workstation, and IP address associated with file activity.
• Audit file and folder creation, deletion, modification, read, move, rename, owner changes, permission changes, and audit setting changes.
• Track failed read, write, and delete attempts.
• Receive alerts for suspicious or high-risk file activity.
• Audit Windows failover clusters for highly available file server environments.
• Automate review through scheduled reports.
• Support compliance requirements such as SOX, HIPAA, the PCI DSS, and the GLBA.

Supported systems and storage scope

Category	Supported / audited items
Windows Server versions	Windows Server 2008 / 2008 R2, 2012 / 2012 R2, 2016, 2019, 2022, and 2025
Legacy reference	Windows Server 2003 / 2003 R2 is past end-of-life support from Microsoft and should not be used for new deployments. Legacy audit policy notes are retained only for older environments.
Share types	SMB, CIFS, DFS, DFSR
Volume types	Mounted volume, SAN volume, junction path
File and folder activity	Created, deleted, modified, read, copied and pasted, moved, renamed, owner changes, permission changes, audit setting changes, failed read/write/delete attempts

Note: Files and folders can both be audited. Configure object-level auditing on the specific shares, folders, and files that must generate audit events.