How to create easier reporting for Windows auditing?

Hello,

My dad has all his important files in a folder named "IMP" in E: in Windows 7. I've set auditing object access failure and enabled auditing on the IMP folder and denied read access and delete folder for all other users.

Everything is working fine and I can check the event viewer whenever my dad wants to have a look at the logs. The problem is I am not always present when he wants to have a look at the logs and since he isn't too tech savvy it would be very difficult for him to go to event viewer, filter the log with event id no. 4656, Event Sources: Microsoft Windows security auditing, Task category: File System.

I was wondering if there is an easier way of generating logs for eg. automatically create a notepad file with all those filters once the audit failure triggers.

Please help

bobafetthotmail said:

Why that anyway? If it is locked to other users what is there to log? Failed attempts to open it?

I really hope you are encrypting your drive, as this measure alone is a bit weak if the disk isn't encrypted. (a punk can simply boot that PC from a Linux liveCD or USB thumbdrive and access the unencrypted disk and those files ignoring the windows policy).

Yes he's interested in knowing who's nosy enough to try and explore his IMP folder. Haven't thought about encrypting the disk. Maybe I'll just encrypt his IMP folder. Thanks alot for the links.

Cheers :)