Submit a ticketCall us

AnnouncementsChange Is Inevitable

Get valuable help when it comes to tracking and monitoring changes. SolarWinds® Server Configuration Monitor (SCM) is designed to help you: detect, track, and receive alerts when changes occur, correlate system performance against configuration changes, compare server and application configuration against custom baselines, and verify application and system changes.

Learn more.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Enable File Auditing in Windows

Enable File Auditing in Windows

Table of contents

Updated: September 24, 2018

Overview

File auditing in Windows allows monitoring of events related to users accessing, modifying, and deleting sensitive files and folders on your network. To maximize the value of this type of auditing, only enable file auditing on a file server where a LEM Agent is installed, and only for the specific files and folders you want to monitor. Enabling file auditing on a large number of files or folders will result in an unnecessary number of log events on the LEM appliance.

Environment

  • All LEM versions running on Windows

Steps

  1. Enable object auditing in Windows:
    1. Navigate to Administrative Tools > Local Security Policy.
    2. In the left pane, expand Local Policies, and then click Audit Policy.
    3. Select Audit object access in the right pane, and then click Action > Properties.
    4. Select Success and Failure.
    5. Click OK.
    6. Close the Local Security Policy window.
  2. To enable file auditing on a file or folder in Windows:
    1. Locate the file or folder you want to audit in Windows Explorer.
    2. Right-click the file or folder and then click Properties.
    3. Click the Security tab.
    4. Click Advanced.
    5. Click the Auditing tab.
    6. If you are using Windows Server 2008, click Edit.
    7. Click Add.
    8. Enter the name of a user or group you want to audit for the selected file or folder, and click Check Names to validate your entry. For example, enter Everyone.
    9. Click OK.
    10. Select Success and Failure next to Full control to audit everything for the selected file or folder.
    11. Optionally, clear Success and Failure for unwanted events, such as:
      • Read attributes
      • Read extended attributes
      • Write extended attributes
      • Read permissions
    12. Click OK in each window until you are back at the Windows Explorer window.
    13. Repeat these steps for all files or folders you want to audit.

 

 

Last modified

Tags

Classifications

Public