Windows 10 Object, File And Folder Auditing

Windows 10 Object, File And Folder Auditing

  In Windows 10 we should monitor who is accessing the files and folders on the computers. To be able to monitor and then view such events we need to enable object auditing in the Group Policy Editor and then enable auditing on the individual objects. Inheritance can be used but it can also be disabled. This video shows the entire process (from enabling group policy to event viewer) - it is very easy and only takes a few minutes. This can be used in Windows 8.1 too.



 
Transcript (machine generated so it contains errors)
Hello today we shall look at file, folder and object access rating. This way we can check to see who has access a file or folder with user of the many changes on files, folders, et cetera okay, we need to get to the screen. How do we get to the screen. Basically gpedit.msc okay and learned, you need to basically admin privileges we get to hear an answer here. We need to go window settings is okay security settings and their local policies and then on a policy and then add on object access we have that opening the screen, which is over here now. We need to enable success and failure, and then we can click apply and okay okay. Does the dollar. Once okay. Now that we have enabled in the local group policy editor honoured object access okay. What we need to do now is select the file or folder object that we want to actually monitor again this case will just folder and file within it, that's fine. Okay, what's and now this is a silently one-on-one until it is assumed, this has all latest accounting figures people salary et cetera so we want to monitor to make sure no one is accessing should be accessing it. Okay, click on properties. There are security sector and advanced second auditing in case you need to be meant to build click yes the principal 1 to one monitor all types of activities and all kinds of monitoring such as failures, et cetera and we could disable inheritance. For example, the being previously a different monitoring or whatever, and now we want to remove monitoring on the file located disable inheritance and change resulting settings. Okay, we'll go with that amount. That's okay, okay, now when someone accesses this fault we need to see it and we can find in the event you are just take event and then the vendor alliance and then go to Windows lance, a security okay now here. Nothing's happened. Let's axis a little file. Okay, we wrote something to it and said about your event, your refresher – five and it's a 46631 never show us the we have access that file. Perfect brilliant is that and if you have any questions, please let us know. Hope you enjoy watching. Thank you. Visit our YouTube channel: https://www.youtube.com/channel/UCFj1BHYIUYfPWPb1Xn5qFIg