Audit File & Folder Access in Windows 11 & 10

In this video, I want to show you how to

find out who accessed your files and

folders,

or even try to access your files and

folders in Windows 10

by enabling object auditing on your

files and folders.

Before we begin, please note that this

applies only to Windows 10

pro enterprise and education

and the file system should be NTFs.

So if you have windows 10 home, it

doesn't work on Windows 10 home.

Now, that being said, and because what I'm

going to show you uses group policy

management or security policy management,

which is a subset of group policy

management. There are out there some

batch files and some scripts

that can enable this on Windows 10 home,

but this is not officially supported by

Microsoft.

So here I'm gonna show you only the

supported method.

There are three easy steps to achieve

this the first step

is to enable object access auditing on

your windows 10 PC.

The second step is to configure auditing

on the selected files and folders.

And the third step is simply viewing the

audit log.

So let's start with step 1, which is

enabling object access auditing in

Windows 10.

So on your Windows 10 PC start group

policy editor.

So click in your search box and type

group

space poll. And here you see group policy.

Alternatively, you can start only

security policy which leads

only to the security settings of the

computer. But here I'm showing you group

policy.

So let me enlarge this a little bit so

that you can see.

And here under group policy, you see that

you have local computer policy, which is

your computer.

And you have two branches computer

configuration and user configuration.

The one that is of interest to us is

computer configuration.

And then under computer configuration

you have Windows settings,

click on it to expand it, and then you

have security settings.

Also click on it to expand it, and you

have under security settings.

Something called advanced audit policy

configuration.

So here, also click on the small arrow

next to it, just to expand it.

And then click on system audit policies,

and you have a bunch of things here.

The one that is of interest to us is

object

access. So double click object access,

and under object access, we have to

enable audit

file system only. So double click on it.

Once again,

and here you see, click on configure the

following audit events,

and then select success and failure.

Success means that if someone succeeds

in accessing the file that or the folder

that you have audited,

it will show you and if someone tried to

access but couldn't do it.

It will also show you this is a failure.

So click ok here,

and with the group policy, we have

finished. So this was the first part,

the second part is to apply.

The security policy that we just enabled

to a certain file or folder.

So here I'm gonna open documents.

And let's say under documents, I have

folder called personal.

So let's say we have these under

personal,

and I want to audit all accesses to

personal.

So right click on it. Click properties

and then click security,

under security, click advanced,

under advanced, click auditing,

click continue. And then here you have to

select

the users you want to audit. So

click on add.

And then click on select principle, and

if you have a user in mind that you want

to audit.

You can select it here. So let me click

advanced,

and find now so you can select either a

user,

or you can select a group. So we have all

these groups here.

And all the users. Let's say we want to

audit everyone.

So if we want to audit everyone, we have

to select

the built-in group everyone and then

click ok,

and then click ok again. And then under

type, you notice

that success was selected by default. So

click

the drop down list. And you see, you have

all

fail and success. So select all.

So this way, you will audit the succeeded

attempts

on your files and folders and also the

failed attempts in case

someone who doesn't have access to this

folder, try to access it or to this file.

Of course,

and then afterwards here click on full

control,

and then click ok.

Now, if you select everyone, please note

that

also your user access will be audited. So

it's better to select

a group that doesn't contain your user,

or select

only one user. But here for the purpose

of this video, I selected everyone.

So here click ok, and then

ok again and now personal

is being audited and everything under

personal also is being audited.

So let's try to access something under

personal.

So I just entered into personal. So this

should be

logged into the event log. So I'm gonna

show you also how to see the event

viewer log,

and let me create a new document. So let

me create a bitmap image.

And let me delete this new text document.

Let me go into test. And let me also

create

here a rich text document.

And let's see now if all these actions

were logged.

So to see the actions, you need to go

into something called

event viewer. So event viewer, you have

many ways to

launch it. So either in the search box,

you can type event.

And it will show here you can also right

click the windows logo,

and here it is event viewer, you can

start computer management

by typing computer

management into the search box

and selecting computer management. It is

also under computer management. So let's

go with computer management,

and here, you have something called event

viewer.

Click on the arrow next to it to expand

it,

and under Windows logs, you have

something called security,

and this is a security log where all

accesses should be logged.

So let me click on it so here you have

all the accesses that were done on the

folder. And the files in the folder.

So let's see them. Let me double click

the first one

you see here under subject, you have

first account name.

So this is a account that accessed the

object.

If you're here, scroll down a little bit. You

see that

the folder test was accessed, and what

was the access type, keep on scrolling.

And you see that the access was reading

the attributes. So here you can click on

the next arrow.

So here, this is important. This is an

event saying that

data was written or a file was added. You

can click on details to see further

information here.

So we have everything here. So this is

here the new file that we created

the new rich text document.

And this is also important here. You see

that we found the event,

that is delete event. And also if you

click on details, you see what was

deleted.

So this is a text document was deleted.

And by whom it was deleted also, and this

is the most important thing.

So you can see here who deleted the file.

If you scroll up, it is this user

and you have the time. And you have the

file, and you have all the information

you need.

But as you noticed, it writes lots of

events.

So now you have to make a compromise

between selecting

one user, only to audit or a small group

of users

or everyone. So if you suspect that your

system is under attack,

it's always better to audit the everyone

group

for a short period of time. And you can

always increase the size of the security

log in event viewer.

So that older entries don't get

overwritten, if you don't see them for a

couple of days.

But I don't advise you to keep the

everyone group

auditing all the time. So let me show you

a little bit how to increase,

the volume of the security log. So here

let me click on close,

right. Click the security log here and

then,

click on properties.

And then under properties here, you can

see you have the maximum log size.

So here it's in kilobytes. So this is 20

mega. So if you want to put it,

200 max. So just put it here

200 megs. So here you have also the

option to overwrite events as needed,

meaning if you reach the maximum volume,

it will

start overwriting other events. And also

you can archive the log when full

or do not overwrite events but clear

load manually. But this will block your

system from working,

if the event log reaches the maximum

value, and you don't clear it.

So I advise you to keep it overwrite

events as needed. And keep it like this,

and let's click ok here. So it's only

telling me that

it will set the nearest multiple of 64k.

So I'm gonna click on ok. So on top of

accessing each event,

and then scrolling to see the next one,

you can also

either find an event, or filter the event.

So let me show you both

very quickly. So if you right click on

security here,

and then select filter current log and

herem you have a bunch of options that

you can choose to find the information

you want,

And the second method is to right click

security, and then click on find.

And here also you can put a string and

try to find it

in the log. So that was it. I hope you

enjoyed this video, and found it useful

if you did.

Please share it. Subscribe to my channel,

and give this video a thumbs up.

Until next time, thank you for watching.