SOLVED: How To Enable File Auditing

A month ago we had a client that had a successful attack on their infrastructure and to protect themselves one of more than 100 changes included auditing a few folders. Specifically they wanted to have a listing stored somewhere every time someone accessed a particular folder.

To enable folder auditing on Windows Server or Client (i.e. Windows 11), follow these steps:

Click to Expand Screenshot

1. Enable the Audit Policy:
   • Open the Group Policy Management Console (GPMC) or Local Group Policy Editor (gpedit.msc).
   • Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access.
   • Enable the Audit File System policy. You can choose to audit Success, Failure, or both2.
2. Configure Auditing on the Folder:
   • Right-click the folder you want to audit and select Properties.
   • Go to the Security tab and click Advanced.
   • In the Advanced Security Settings window, go to the Auditing tab.
   • Click Add, then select the Principal (user or group) you want to audit.
   • Choose the Type of access to audit (Success, Failure, or both).
   • Specify the Applies to setting (this folder, subfolders, and files).
   • Select the Permissions you want to audit (e.g., Read, Write, Delete)2.
3. View Audit Logs:
   • Open the Event Viewer.
   • Navigate to Windows Logs > Security to view the audit events. Look for events with ID 4663 for file access

Click to Expand Screenshot

While not absolutely required, it’s a very good idea to expand the size of your windows security event log because auditing creates a lot of entries and you will find it fills up and starts deleting the oldest entries fairly quickly.

You can see in the screen shot above we did that by simply right clicking on the security log, selecting properties and we tripled our size to 60MB, which is still quite small. As such we notified the client that if they are concerned something has been accessed that they are worried about they should notify us quickly, so we could get the information before it gets deleted.