Windows Server 2012 R2 File Share Auditing

On windows server 2012 auditing file and folder accesses consists of two parts.

Windows server 2012 r2 file share auditing. Detailed file share audit events include detailed information about the permissions or other criteria used to grant or deny access. Click the auditing tab third tab from the left. Right click the file or folder and then click properties. Enable file and folder auditing which can be done in two ways.

For example using file classification and dac you can configure a windows server 2012 r2 file server so that all files that contain the phrase code secret are marked as sensitive. You can then configure global object access auditing so that all access to files marked as sensitive are automatically audited. Open the property of a share you d like to audit and move to auditing tab and click add button. Input username or group name you d like to add auditing and click ok button.

This video covers the basics of auditing in windows server 2012 r2 including the security log using group policy to create audit policies and the auditpol. Click the security tab at top. In this article the process of enabling files and folders auditing on windows server 2012 has been explained. To enable file auditing on a file or folder in windows.

Existing file access events 4656 4663 contain information about the attributes of the file that was accessed. Thus it is important to audit all user actions concerning files and folders access. The detailed file share setting logs an event every time a file or folder is accessed whereas the file share setting only records one event for any connection established between a client computer and file share. Navigate to the required file share folder right click it and select properties select security tab advanced button auditing tab click add button.

This video will demonstrate how to enable the object audit feature on a computer running windows 2012 in order the detect who deleted your files and folders. Lets setup this audit policy on our windows server 2012 r2 server. Locate the file or folder you want to audit in windows explorer. With the right audit policy in place the windows and windows server operating systems generate an audit event each time a user accesses a file.