Troubleshooting

File Server shares are not discovered

Symptom: ADAudit Plus does not list expected shares for a configured File Server.

Resolution:

• Verify that the File Server is online and reachable from the ADAudit Plus server.
• Verify the domain data collection identity has the required privileges for share discovery.
• Confirm membership in the local Power Users group or equivalent required privileges.
• Verify WMI/DCOM/RPC status check access if you are using UI-based audit policy status checks.

Access denied when reading event logs

Symptom: ADAudit Plus cannot read Security events from the File Server.

Resolution:

• Verify membership in the local Event Log Readers group on the File Server.
• Verify Manage auditing and security log is assigned to the domain data collection identity.
• Confirm the Security log is available and not restricted by local hardening policies.

Cannot access audited shares

Symptom: Shares are configured, but file events are missing or access errors appear.

Resolution:

• Verify the data collection identity has Share Read and NTFS Read permissions on audited shares.
• Alternatively, verify membership in the File Server's local Administrators group if that is your chosen approach.
• Confirm the share path is valid and reachable.
• Confirm SACL entries are configured on the audited folder or file.

File activity is missing from reports

Symptom: File operations occur, but reports do not show expected activity.

Resolution:

• Confirm required audit policies are configured using Configure audit policies.
• Confirm object-level auditing is configured using Configure object-level auditing (SACL).
• Verify events are generated in Event Viewer on the File Server.
• Confirm the Security log is not overwriting events too quickly.
• Check whether exclusions are suppressing the expected activity.

Object-level auditing status is red or orange

Symptom: ADAudit Plus shows a red or orange object-level auditing status for one or more shares.

Resolution:

• Hover over the share status to view the error details.
• If status is orange, wait for configuration to complete and refresh.
• If status is red, verify SACL configuration privileges and retry applying object-level auditing.
• Manually verify SACL entries on the folder if automatic configuration fails.

Exclusions are not working as expected

Symptom: Excluded files/folders still appear in reports, or expected audit data is missing.

Resolution:

• Verify the exclusion type: File/Folder local path, File Type, Process Name, or Users.
• Confirm whether you used File/Folder Patterns or Regex Patterns.
• Check the path syntax carefully, especially backslashes in regex patterns.
• Confirm that the excluded path matches the local path as seen by the File Server.

Frequently asked questions (FAQ)

Can ADAudit Plus audit both files and folders?

Yes. ADAudit Plus can audit activity on shares, folders, and files when the required audit policies and object-level auditing settings are configured.

Does ADAudit Plus configure audit policies automatically?

ADAudit Plus can configure audit policies automatically if you choose automatic configuration and the data collection identity has the required permissions. You can also configure the policies manually.

What is the purpose of the ADAuditPlusFS group?

The ADAuditPlusFS domain local security group is used for GPO security filtering so the File Server audit policy GPO applies only to monitored File Servers.

What is the purpose of ADAuditPlusFSPolicy?

ADAuditPlusFSPolicy is the GPO used to configure audit policy and Security log settings for monitored Windows File Servers.

Why must object-level auditing be configured?

Audit policies enable Windows to log broad event categories. Object-level auditing defines which shares, folders, files, and operations generate file activity events.

Why does the guide include legacy audit policy guidance?

Legacy audit policy guidance is retained only for older environments where advanced audit policies are not available. Windows Server 2003 / 2003 R2 is past end-of-life support from Microsoft and should not be used for new deployments.

What Security log size should I use?

Use at least 4096MB for Windows Server 2008 and above, and increase it if the Security log cannot retain at least 12–24 hours of file activity events.

Can I exclude noisy folders or file types?

Yes. Go to File Audit > Configuration > Exclude Configuration and use this section to exclude by file/folder local path, file type, process name, or user name.