Audit (log) Access to Shared Folders

Page 1 of 2 12 LastLast
    Audit (log) Access to Shared Folders

    Audit (log) Access to Shared Folders

    How to audit user access to shared folders on your computer
    Published by
    Designer Media Ltd


       Information

    Auditing access to your shared folders makes it possible to keep track of what's happening; who visits your shared folders, when, doing what. It might not be needed on a "Me and my laptop" networks, although in my opinion it adds a bit to general security to your system and network. When needed, the information is there. Auditing logs are very small files, taking almost no space on hard disk. Auditing does not "eat" the resources of your computer, does not make it slower.

    Auditing options can be edited using Windows 7 built-in Group Policy Editor, included in Seven Professional, Ultimate and Enterprise editions. There are also several third party alternatives, for instance ShareAlarmPro. This tutorial is however about how to do it with gpedit.







    Audit access to shared folders:
    1. Open Group Policy Editor by typing gpedit.msc to Start menu's search field or Run dialog window and hit Enter
      .
    2. Go to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies Audit Policy, double click to open Audit Object Access

      Audit (log) Access to Shared Folders-audit_1.png
      .
    3. Check both options (Success and Failure) under Audit these objects, click OK

      Audit (log) Access to Shared Folders-audit_2.png
      .
    4. Close Group Policy Editor
      .
    5. Open the Properties of a shared folder you want to audit, choose Security tab, click Advanced

      Audit (log) Access to Shared Folders-audit_3.png
      .
    6. Choose Audit tab, click Continue

      Audit (log) Access to Shared Folders-audit_4.png
      .
    7. Click Add, click Locations to choose from which location you want to audit, write the computer name and name of a user or group you want to audit, for instance PC-3\Administrators or XPPro-upstairs\Kari. Click Check names to "spellcheck", to check validity of your input

      Audit (log) Access to Shared Folders-audit_5.png
      .
    8. Click OK to close Select User or Group dialog, click OK to close Advanced Security Settings, click OK to close Folder Properties
    That's it. To read audit log, open Event Viewer by typing Event Viewer to Start menu's search field or Run dialog window and hit Enter. Go to Windows Logs > Security

    Audit (log) Access to Shared Folders-audit_6.png

    Any further questions, don't hesitate to ask.

    Kari









  1. Posts : 22,814
    W 7 64-bit Ultimate
       #1

    Nice work Kari, well done!
      My Computer


  2. Posts : 17,545
    Windows 10 Pro x64 EN-GB
    Thread Starter
       #2

    Thanks, Ted. Means a lot coming from you.
      My Computer


  3. Posts : 8,476
    Windows® 8 Pro (64-bit)
       #3

    Excellent tutorial mate. I never knew such thing existed.
      My Computer


  4. Posts : 17,545
    Windows 10 Pro x64 EN-GB
    Thread Starter
       #4

    Thank you, Dinesh.
      My Computer


  5. Posts : 9,582
    Windows 8.1 Pro RTM x64
       #5

    Good work, Kari.
      My Computer


  6. Posts : 2,737
    Windows 7 Enterprise (x64); Windows Server 2008 R2 (x64)
       #6

    Very well done!
      My Computer


  7. Posts : 4,772
    Windows 7 Ultimate - 64-bit | Windows 8 Pro - 64-bit
       #7

    Great Work Kari !
      My Computer


  8. Posts : 53,363
    Windows 10 Home x64
       #8

    Great tute Kari

    A Guy
      My Computer


  9. Posts : 12,177
    Windows 7 Ult x64 - SP1/ Windows 8 Pro x64
       #9

    Nice tutorial, Good work.
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 22:52.
Find Us