Audit (log) Access to Shared Folders

   Information

Auditing access to your shared folders makes it possible to keep track of what's happening; who visits your shared folders, when, doing what. It might not be needed on a "Me and my laptop" networks, although in my opinion it adds a bit to general security to your system and network. When needed, the information is there. Auditing logs are very small files, taking almost no space on hard disk. Auditing does not "eat" the resources of your computer, does not make it slower.

Auditing options can be edited using Windows 7 built-in Group Policy Editor, included in Seven Professional, Ultimate and Enterprise editions. There are also several third party alternatives, for instance ShareAlarmPro. This tutorial is however about how to do it with gpedit.







Audit access to shared folders:
  1. Open Group Policy Editor by typing gpedit.msc to Start menu's search field or Run dialog window and hit Enter
    .
  2. Go to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies Audit Policy, double click to open Audit Object Access

    audit_1.png
    .
  3. Check both options (Success and Failure) under Audit these objects, click OK

    audit_2.png
    .
  4. Close Group Policy Editor
    .
  5. Open the Properties of a shared folder you want to audit, choose Security tab, click Advanced

    audit_3.png
    .
  6. Choose Audit tab, click Continue

    audit_4.png
    .
  7. Click Add, click Locations to choose from which location you want to audit, write the computer name and name of a user or group you want to audit, for instance PC-3\Administrators or XPPro-upstairs\Kari. Click Check names to "spellcheck", to check validity of your input

    audit_5.png
    .
  8. Click OK to close Select User or Group dialog, click OK to close Advanced Security Settings, click OK to close Folder Properties
That's it. To read audit log, open Event Viewer by typing Event Viewer to Start menu's search field or Run dialog window and hit Enter. Go to Windows Logs > Security

audit_6.png

Any further questions, don't hesitate to ask.

Kari






 
Last edited by a moderator:
Nice work Kari, well done!
 

My Computer

Computer Manufacturer/Model Number
* BFK Customs *
OS
W 7 64-bit Ultimate
CPU
Intel Q9550 Yorkfield
Motherboard
ASUS P5Q Pro
Memory
8GB Dominator 8500C5D
Graphics Card(s)
ATI : XFX 5870
Sound Card
Realtek HD Audio 7-1
Monitor(s) Displays
1x 47" LCD HDMI & 3x 26" LCD HDMI
Screen Resolution
1920x1080P & 1920x1200
Hard Drives
1x 80GB Intel X25-M G2 SSD : 1x 500GB & 1x 640GB WD Caviar Black(s)
PSU
Corsair 620HX
Case
Cooler Master RC-690
Cooling
Tuniq Tower 120, 2x 140mm and 3x 120mm case fans
Keyboard
Microsoft 500
Mouse
Razer Diamondback 3G
Internet Speed
14 Mb/s
Other Info
1x Koutech 3Gb/s SATA HDD Hot Swap Rack
Thanks, Ted. Means a lot coming from you.
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
HP ENVY 17-1150eg
OS
Windows 10 Pro x64 EN-GB
CPU
1.6 GHz Intel Core i7-720QM Processor
Memory
6 GB
Graphics Card(s)
ATI Mobility Radeon HD 5850 Graphics
Sound Card
Beats sound system with integrated subwoofer
Monitor(s) Displays
17" laptop display, 22" LED and 32" Full HD TV through HDMI
Screen Resolution
1600*900 (1), 1920*1080 (2&3)
Hard Drives
Internal: 2 x 500 GB SATA Hard Disk Drive 7200 rpm
External: 2TB for backups, 3TB USB3 network drive for media
Cooling
As Envy runs a bit warm, I have it on a Cooler Master pad
Keyboard
Logitech diNovo Media Desktop Laser (bluetooth)
Mouse
Logitech Performance Mouse MX
Internet Speed
50/10 Mbps VDSL
Antivirus
Windows Defender 4.3.9431.0
Browser
Maxthon 3.5.2., IE11
Excellent tutorial mate. I never knew such thing existed. :o
 

My Computer

Computer Manufacturer/Model Number
Samsung NP530U4B-S02IN
OS
Windows® 8 Pro (64-bit)
CPU
Intel® Core™ i5 Processor 2467M (1.60GHz, 3MB L3 Cache)
Motherboard
Samsung Electronics
Memory
6GB DDR3 System Memory at 1,333MHz (on BD 4GB + 2GB x 1)
Graphics Card(s)
AMD Radeon™ HD7550M 1GB DDR3 (Ext. Graphic)
Sound Card
Realtek High Definition Audio
Monitor(s) Displays
35.56cm (14.0) SuperBright 300nit HD LED Display
Screen Resolution
1366x768
Hard Drives
1TB S-ATA II Hard Drive (5400RPM) with ExpressCache 16GB SSD
Internet Speed
sucks
Antivirus
Microsoft Security Essentials
Browser
Google Chrome (Sync enabled)
Thank you, Dinesh.
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
HP ENVY 17-1150eg
OS
Windows 10 Pro x64 EN-GB
CPU
1.6 GHz Intel Core i7-720QM Processor
Memory
6 GB
Graphics Card(s)
ATI Mobility Radeon HD 5850 Graphics
Sound Card
Beats sound system with integrated subwoofer
Monitor(s) Displays
17" laptop display, 22" LED and 32" Full HD TV through HDMI
Screen Resolution
1600*900 (1), 1920*1080 (2&3)
Hard Drives
Internal: 2 x 500 GB SATA Hard Disk Drive 7200 rpm
External: 2TB for backups, 3TB USB3 network drive for media
Cooling
As Envy runs a bit warm, I have it on a Cooler Master pad
Keyboard
Logitech diNovo Media Desktop Laser (bluetooth)
Mouse
Logitech Performance Mouse MX
Internet Speed
50/10 Mbps VDSL
Antivirus
Windows Defender 4.3.9431.0
Browser
Maxthon 3.5.2., IE11
Good work, Kari.
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dwarf Dwf/11/2012 r09/2013
OS
Windows 8.1 Pro RTM x64
CPU
Intel Core-i5-3570K 4-core @ 3.4GHz (Ivy Bridge) (OC 4.4GHz)
Motherboard
ASRock Z77 Extreme4-M
Memory
4 x 4GB DDR3-1600 Corsair Vengeance CMZ8GX3M2A1600C9B (16GB)
Graphics Card(s)
MSI GeForce GTX770 Gaming OC 2GB
Sound Card
Realtek High Definition on board solution (ALC 898)
Monitor(s) Displays
ViewSonic VA1912w Widescreen (VGA)
Screen Resolution
1440x900
Hard Drives
OCZ Agility 3 SSD 120GB SATA III x2 (RAID 0)
Samsung HD501LJ 500GB SATA II x2
Hitachi HDS721010CLA332 1TB SATA II
Iomega 1.5TB Ext USB 2.0
WD 2.0TB Ext USB 3.0
PSU
XFX Pro Series 850W Semi-Modular
Case
Gigabyte IF233
Cooling
1 x 120mm Front Inlet 1 x 120mm Rear Exhaust
Keyboard
Microsoft Comfort Curve Keyboard 3000 (USB)
Mouse
Microsoft Comfort Mouse 3000 for Business (USB)
Internet Speed
NetGear DG834Gv3 ADSL Modem/Router (Ethernet) ~4.0 Mb/s (O2)
Antivirus
Avast! 8.0.1497
Browser
IE 11
Other Info
Optical Drive: HL-DT-ST BD-RE BH10LS30 SATA Bluray
Lexmark S305 Printer/Scanner/Copier (USB)
WEI Score: 8.1/8.1/8.5/8.5/8.25
Asus Eee PC 1011PX Netbook (Windows 7 x86 Starter)
Very well done!
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell OP7010
OS
Windows 7 Enterprise (x64); Windows Server 2008 R2 (x64)
Memory
16GB
Monitor(s) Displays
4 Dell 24" LCD
Screen Resolution
1280x1024
Keyboard
Dell
Mouse
Dell Optical
Internet Speed
40meg
Great Work Kari !
 

My Computer

Computer Manufacturer/Model Number
Samsung NP550P5C-S02IN
OS
Windows 7 Ultimate - 64-bit | Windows 8 Pro - 64-bit
CPU
Intel® Core™ i7 Processor 3,610QM (2.30Hz, 6MB L3 Cach
Memory
8 GB
Graphics Card(s)
NVIDIA® GeForce® GT 650M 2GB Graphics, Optimus™ techno
Sound Card
SoundAlive™ JBL 3 Speakers (With sub-Woofer)
Monitor(s) Displays
39.62cm (15.6) SuperBright 300nit HD+ LED Display
Screen Resolution
1,600 x 900, Anti-Reflective
Hard Drives
1TB S-ATA II Hard Drive (5,400RPM)
Great tute Kari :thumbsup:

A Guy
 

My Computer

Computer type
PC/Desktop
OS
Windows 10 Home x64
CPU
INTEL Core i5-750 Quad-Core 3.37GHz
Motherboard
ASUS P7P55D
Memory
HyperX Fury Black Series 8GB (2 x 4GB) 1866Mhz
Graphics Card(s)
EVGA GeForce GTX 750 Superclocked 1GB 128-Bit GDDR5
Monitor(s) Displays
LG 32MA68HY 32" IPS
Screen Resolution
1920 x 1080
Hard Drives
Samsung 840 Evo 120GB, SEAGATE 500GB Barracuda® 7200.12, SATA 3 Gb/s, 7200 RPM, 16MB cache
PSU
ANTEC TruePower New TP-550, 80 PLUS, 550W
Case
ANTEC Three Hundred Illusion
Cooling
COOLER MASTER Hyper 212 Plus, 4 x 120mm 1 x 140mm Noctua's
Internet Speed
85 + Mbps
Antivirus
Avast
Browser
Vivaldi
Nice tutorial, Good work.
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
76~2.0
OS
Windows 7 Ult x64 - SP1/ Windows 8 Pro x64
CPU
Intel Core i5-3570K 4.6GHz
Motherboard
Gigabyte GA-Z77X UD3H, f18
Memory
8GB (2X4GB) DDR3 1600 Corsair Vengeance CL8 1.5v
Graphics Card(s)
Sapphire HD 7770 Vapor-X OC 1GB DDR5
Sound Card
Onboard VIA VT2021
Monitor(s) Displays
22" LCD Dell
Screen Resolution
1680x1050
Hard Drives
Samsung 840Pro 128GB SSD,
Seagate Barracuda 500GB SATA2 7200rpm 32MB cache, Seagate Barracuda 1TB SATA2 7200rpm 32MB cache,
PSU
Corsair HX650W
Case
Cooler Master Storm Scout
Cooling
Corsair H80 2x12cm Noctua NF P12 , 2x14cm case fans
Keyboard
Logitech Wave
Mouse
CM Sentinel
Internet Speed
Dismal
Antivirus
Avast
Browser
Opera Next
Other Info
Haswell laptop: HP Envy 17t-j, i7-4700MQ, GeForce 740M 2GB DDR3, 17.3" Full HD 1920x1080, 16GB RAM, Samsung 840 Pro 128GB, 1TB Hitachi 7200 HDD,
Desktop: eSATA ports,
External eSATA Seagate 500GB SATA2 7200rpm,
External WD USB 500GB
Thnaks Kari,I have a question,when i did this setting then i found that it creates many logs and u must check one by one to achieve the aim,and its boring! :(
 

My Computer

Computer type
PC/Desktop
OS
Windows 7 Ultimate 64bit
CPU
Intel Corei7
Memory
4GB
Graphics Card(s)
nVIDIA GeForce
Hi Sali, welcome to the Seven Forums.

Yes, it can be boring. This method suits those who have to control what's happening on their computers, who's doing what on their computers.

Logs can be boring; it's up to you to decide if you need logging.

Kari
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
HP ENVY 17-1150eg
OS
Windows 10 Pro x64 EN-GB
CPU
1.6 GHz Intel Core i7-720QM Processor
Memory
6 GB
Graphics Card(s)
ATI Mobility Radeon HD 5850 Graphics
Sound Card
Beats sound system with integrated subwoofer
Monitor(s) Displays
17" laptop display, 22" LED and 32" Full HD TV through HDMI
Screen Resolution
1600*900 (1), 1920*1080 (2&3)
Hard Drives
Internal: 2 x 500 GB SATA Hard Disk Drive 7200 rpm
External: 2TB for backups, 3TB USB3 network drive for media
Cooling
As Envy runs a bit warm, I have it on a Cooler Master pad
Keyboard
Logitech diNovo Media Desktop Laser (bluetooth)
Mouse
Logitech Performance Mouse MX
Internet Speed
50/10 Mbps VDSL
Antivirus
Windows Defender 4.3.9431.0
Browser
Maxthon 3.5.2., IE11
Thanks Kari for such a nice article on Auditing
kari! it is feasible to apply this on Enterprise level where we have many users and OU as well
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
LG
OS
windows 7 home Premium 64 bit
CPU
zebronics
Memory
4 gb
Hard Drives
360

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
HP ENVY 17-1150eg
OS
Windows 10 Pro x64 EN-GB
CPU
1.6 GHz Intel Core i7-720QM Processor
Memory
6 GB
Graphics Card(s)
ATI Mobility Radeon HD 5850 Graphics
Sound Card
Beats sound system with integrated subwoofer
Monitor(s) Displays
17" laptop display, 22" LED and 32" Full HD TV through HDMI
Screen Resolution
1600*900 (1), 1920*1080 (2&3)
Hard Drives
Internal: 2 x 500 GB SATA Hard Disk Drive 7200 rpm
External: 2TB for backups, 3TB USB3 network drive for media
Cooling
As Envy runs a bit warm, I have it on a Cooler Master pad
Keyboard
Logitech diNovo Media Desktop Laser (bluetooth)
Mouse
Logitech Performance Mouse MX
Internet Speed
50/10 Mbps VDSL
Antivirus
Windows Defender 4.3.9431.0
Browser
Maxthon 3.5.2., IE11
Event Viewer - Monitor User Account Activity in Windows 8

Hi Kary

I have gone through the link you have provided
its indeed an informative article; most of us are unaware about this

Just have some doubts:

1.does these functionality available in windows 8 only or it is there in previous version of the windows like 7, XP

2.I wonder if it works with windows server 2008 ?
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
LG
OS
windows 7 home Premium 64 bit
CPU
zebronics
Memory
4 gb
Hard Drives
360
A bit more limited functions on XP. Seven, Eight, Server 2008 and Server 2012 exactly as described in that tutorial.
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
HP ENVY 17-1150eg
OS
Windows 10 Pro x64 EN-GB
CPU
1.6 GHz Intel Core i7-720QM Processor
Memory
6 GB
Graphics Card(s)
ATI Mobility Radeon HD 5850 Graphics
Sound Card
Beats sound system with integrated subwoofer
Monitor(s) Displays
17" laptop display, 22" LED and 32" Full HD TV through HDMI
Screen Resolution
1600*900 (1), 1920*1080 (2&3)
Hard Drives
Internal: 2 x 500 GB SATA Hard Disk Drive 7200 rpm
External: 2TB for backups, 3TB USB3 network drive for media
Cooling
As Envy runs a bit warm, I have it on a Cooler Master pad
Keyboard
Logitech diNovo Media Desktop Laser (bluetooth)
Mouse
Logitech Performance Mouse MX
Internet Speed
50/10 Mbps VDSL
Antivirus
Windows Defender 4.3.9431.0
Browser
Maxthon 3.5.2., IE11
Thanks Kari
any solution for XP and windows server earlier than 2008 ?
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
LG
OS
windows 7 home Premium 64 bit
CPU
zebronics
Memory
4 gb
Hard Drives
360
I am not familiar with older Windows versions, how to audit them, but basically the idea is the same.
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
HP ENVY 17-1150eg
OS
Windows 10 Pro x64 EN-GB
CPU
1.6 GHz Intel Core i7-720QM Processor
Memory
6 GB
Graphics Card(s)
ATI Mobility Radeon HD 5850 Graphics
Sound Card
Beats sound system with integrated subwoofer
Monitor(s) Displays
17" laptop display, 22" LED and 32" Full HD TV through HDMI
Screen Resolution
1600*900 (1), 1920*1080 (2&3)
Hard Drives
Internal: 2 x 500 GB SATA Hard Disk Drive 7200 rpm
External: 2TB for backups, 3TB USB3 network drive for media
Cooling
As Envy runs a bit warm, I have it on a Cooler Master pad
Keyboard
Logitech diNovo Media Desktop Laser (bluetooth)
Mouse
Logitech Performance Mouse MX
Internet Speed
50/10 Mbps VDSL
Antivirus
Windows Defender 4.3.9431.0
Browser
Maxthon 3.5.2., IE11
Thanks kari for your valuable information about Monitoring of user account Activity
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
LG
OS
windows 7 home Premium 64 bit
CPU
zebronics
Memory
4 gb
Hard Drives
360
Back
Top