Security Compliance

Monitor when a user tries to access a file for which they don't have permissions in SEM

This article details how to audit events where a user tries to open a file or folder they have been denied access to.

First published date

10/15/2018 3:49 PM

Last published date

5/30/2019 8:01 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).

This article details how to configure a SEM email alert that is triggered when a user tries to open a file or folder that they do not have access to. Accessing the file or folder in Windows Explorer returns an Access Denied Error.

Product section

Security Event Manager

Resolution

Due to the nature of Windows auditing, finding events for this specific scenario can be tricky. The following steps are generic and this is not the only filter conditions you can use.

  1. Check for the FileAuditFailure event details in the SEM Console Monitor tab by setting a filter specific for this event type.
  2. Highlight the event, and then find the event details in bottom-right pane. Not all events may have fields and values matching the data. A sample event may have data like below, whereas some fields may not be the same in your case due to OS version and auditing policies, etc.
  3. Always start with one condition. Once the rule starts to fire, build additional filter conditions as shown below.

Note: To actually generate these events, your Windows audit policy must be monitoring Failures for the File System and Handle Manipulation subcategories. You will also need to adjust the auditing on the files/folders in question to monitor failures for File Execution.

Refer to  Troubleshoot SEM rules that are not sending emails or not firing for the general rule troubleshooting guide, which applies to every type of rule not firing.