Audit (log) Access to Shared Folders

How to audit user access to shared folders on your computer
Published 08 Nov 2010

Published by

Kari

Featured Tutorial

Troubleshooting Windows 7 Failure to Boot

Online Scanners - Scan Suspicious Files on your PC
How to Scan Suspicious Files using Online Scanners

Troubleshooting Steps for Windows 7

Clean Up Factory Bloatware

Screen Capture and Video Editing in High Quality

Information

Auditing access to your shared folders makes it possible to keep track of what's happening; who visits your shared folders, when, doing what. It might not be needed on a "Me and my laptop" networks, although in my opinion it adds a bit to general security to your system and network. When needed, the information is there. Auditing logs are very small files, taking almost no space on hard disk. Auditing does not "eat" the resources of your computer, does not make it slower.

Auditing options can be edited using Windows 7 built-in Group Policy Editor, included in Seven Professional, Ultimate and Enterprise editions. There are also several third party alternatives, for instance ShareAlarmPro. This tutorial is however about how to do it with gpedit.

Audit access to shared folders:

Open Group Policy Editor by typing gpedit.msc to Start menu's search field or Run dialog window and hit Enter
.
Go to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies Audit Policy, double click to open Audit Object Access

.
Check both options (Success and Failure) under Audit these objects, click OK

.
Close Group Policy Editor
.
Open the Properties of a shared folder you want to audit, choose Security tab, click Advanced

.
Choose Audit tab, click Continue

.
Click Add, click Locations to choose from which location you want to audit, write the computer name and name of a user or group you want to audit, for instance PC-3\Administrators or XPPro-upstairs\Kari. Click Check names to "spellcheck", to check validity of your input

.
Click OK to close Select User or Group dialog, click OK to close Advanced Security Settings, click OK to close Folder Properties

That's it. To read audit log, open Event Viewer by typing Event Viewer to Start menu's search field or Run dialog window and hit Enter. Go to Windows Logs > Security

Audit (log) Access to Shared Folders-audit_6.png

Any further questions, don't hesitate to ask.

Kari

Related Tutorials

Need more help? Try searching our extensive help and support site.

08 Nov 2010
Bare Foot Kid	Nice work Kari, well done!
My System Specs

08 Nov 2010
Kari	Thanks, Ted. Means a lot coming from you.
My System Specs

08 Nov 2010
Dinesh	Excellent tutorial mate. I never knew such thing existed.
My System Specs

08 Nov 2010
Kari	Thank you, Dinesh.
My System Specs

08 Nov 2010
Dwarf	Good work, Kari.
My System Specs

08 Nov 2010
WindowsStar	Very well done!
My System Specs

08 Nov 2010
Capt.Jack Sparrow	Great Work Kari !
My System Specs

09 Nov 2010
A Guy	Great tute Kari A Guy
My System Specs

10 Nov 2010
Dave76	Nice tutorial, Good work.
My System Specs

Windows 7: Audit (log) Access to Shared Folders

Audit (log) Access to Shared Folders

Audit (log) Access to Shared Folders problems?