Windows 7 - Audit (log) Access to Shared Folders

Kari

Information

Auditing access to your shared folders makes it possible to keep track of what's happening; who visits your shared folders, when, doing what. It might not be needed on a "Me and my laptop" networks, although in my opinion it adds a bit to general security to your system and network. When needed, the information is there. Auditing logs are very small files, taking almost no space on hard disk. Auditing does not "eat" the resources of your computer, does not make it slower.

Auditing options can be edited using Windows 7 built-in Group Policy Editor, included in Seven Professional, Ultimate and Enterprise editions. There are also several third party alternatives, for instance ShareAlarmPro. This tutorial is however about how to do it with gpedit.

Audit access to shared folders:

Open Group Policy Editor by typing gpedit.msc to Start menu's search field or Run dialog window and hit Enter
.
Go to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies Audit Policy, double click to open Audit Object Access

.
Check both options (Success and Failure) under Audit these objects, click OK

.
Close Group Policy Editor
.
Open the Properties of a shared folder you want to audit, choose Security tab, click Advanced

.
Choose Audit tab, click Continue

.
Click Add, click Locations to choose from which location you want to audit, write the computer name and name of a user or group you want to audit, for instance PC-3\Administrators or XPPro-upstairs\Kari. Click Check names to "spellcheck", to check validity of your input

.
Click OK to close Select User or Group dialog, click OK to close Advanced Security Settings, click OK to close Folder Properties

That's it. To read audit log, open Event Viewer by typing Event Viewer to Start menu's search field or Run dialog window and hit Enter. Go to Windows Logs > Security

Audit (log) Access to Shared Folders-audit_6.png

Any further questions, don't hesitate to ask.

Kari

Windows 7 - Audit (log) Access to Shared Folders

Audit (log) Access to Shared Folders

Audit (log) Access to Shared Folders problems?