Welcome! Use the login menu to access:
Customer Portal
SolarWinds customers can download purchased software, renew maintenance, & more in our updated Customer Portal!
Community
After logging in, community members can rate & review SolarWinds software & participate in forums on thwack.com.
Partner Portal
SolarWinds channel partners will find all the resources they need in the Partner Portal, including exclusive partner tools.
| More

SolarWinds Knowledge Base

How to enable file auditing in Windows

Enable file auditing in Windows to monitor events related to users accessing, modifying, and deleting sensitive files and folders on your network. To maximize the value of this type of auditing, enable auditing on a file server on which you have installed a LEM Agent, and only for the specific files and folders you want to monitor. If you enable auditing on all files or folders, or even a large number of them, you will create an unnecessary burden on your LEM appliance by telling Windows to log events you don't want or need to see.

Complete the two-part process below to first enable object auditing on your server, and then enable file auditing on the files and folders you want to audit. Provided Windows is logging the events and your server has a LEM Agent installed on it, your LEM Console will begin displaying the new file auditing alerts immediately.

To enable object auditing in Windows:

  1. Open Administrative Tools > Local Security Policy.
  2. Expand Local Policies and click Audit Policy in the left pane.
  3. Select Audit object access in the right pane, and then click Action > Properties.
  4. Select Success and Failure.
  5. Click OK.
  6. Close the Local Security Policy window.

To enable file auditing on a file or folder in Windows:

  1. Locate the file or folder you want to audit in Windows Explorer.
  2. Right-click the file or folder and then click Properties.
  3. Click the Security tab.
  4. Click Advanced.
  5. Click the Auditing tab.
  6. If you are using Windows Server 2008, click Edit.
  7. Click Add.
  8. Enter the name of a user or group you want to audit for the selected file or folder, and click Check Names to validate your entry. For example, enter Everyone.
  9. Click OK.
  10. Select Success and Failure next to Full control to audit everything for the selected file or folder.
  11. Optionally, clear Success and Failure for unwanted events, such as:
    • Read attributes
    • Read extended attributes
    • Write extended attributes
    • Read permissions
  12. Click OK in each window until you are back at the Windows Explorer window.
  13. Repeat these steps for all files or folders you want to audit.


Related Articles

No related articles were found.

Attachments

No attachments were found.

Visitor Comments

No visitor comments posted. Post a comment

Post Comment for "How to enable file auditing in Windows"

If this article does not provide the solution you need, please consider visiting our community forums on thwack or contacting SolarWinds Support. Please use the following form to provide comments that help us improve this KB article. Fields marked with an asterisk are required.

   Name:
* Email:
* Comment:
* Enter the code below:

 

Article Details

Last Updated
22nd of December, 2011

Would you like to...

Print this page  Print this page

Email this page  Email this page

Post a comment  Post a comment

 Subscribe me

Subscribe me  Add to favorites

Remove Highlighting Remove Highlighting

Edit this Article

Quick Edit

Export to PDF


User Opinions

No users have voted.

How would you rate this answer?




Thank you for rating this answer.

Continue