I've implemented a shared work folder for employees in my company. Then arise a question: what if an employee delete all the work by others?
So I would like to log all activities in that folder, including:
- User ... Read file ... at ... on ...
- User ... Write file ... at ... on ...
- User ... Delete file .... at ... ...
Do you know how to do it on Windows 7 or any logging software that helps me monitor activities within that folder?
Thanks.
Go to the properties of the folder, click the Advanced button, and click the Auditing tab. You can create auditing rules (that will be logged in the security event log) here. You will, however, need to enable the "Audit File System" policy under local (or group) policy on the server under Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access, refresh policy, and reboot (due to policy caching) for your audit policies to actually work. I would suggest enabling both Success and Failure in this policy, as only an access with a matching SACL configured in an auditing policy for a specific folder will get logged (unlike some of the other global logging of file or registry activity, which is all or nothing regardless of folder policies).
Quote