Information
Auditing access to your shared folders makes it possible to keep track of what’s happening; who visits your shared folders, when, doing what. It might not be needed on a “Me and my laptop” networks, although in my opinion it adds a bit to general security of your system and network. When needed, the information is there. Auditing logs are very small files, taking almost no space on hard disk. Auditing does not “eat” the resources of your computer, does not make it slower.
Auditing options can be edited using Windows 7 built-in Group Policy Editor, included in Seven Professional, Ultimate and Enterprise editions. There are also several third party alternatives, for instance ShareAlarmPro. This tutorial is however about how to do it with gpedit.
Here’s How:
1. Open Group Policy Editor by typing gpedit.msc to Start menu’s search field or Run dialog window and hit Enter
2. Go to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies Audit Policy, double click to open Audit Object Access
3. Check both options (Success and Failure) under Audit these objects, click OK
4. Close Group Policy Editor
5. Open the Properties of a shared folder you want to audit, choose Security tab, click Advanced
6. Choose Audit tab, click Continue
7. Click Add, click Locations to choose from which location you want to audit, write the computer name and name of a user or group you want to audit, for instance PC-3\Administrators or XPPro-upstairs\Kari. Click Check names to “spellcheck”, to check validity of your input
8. Click OK to close Select User or Group dialog, click OK to close Advanced Security Settings, click OK to close Folder Properties
That’s it. To read audit log, open Event Viewer by typing Event Viewer to Start menu’s search field or Run dialog window and hit Enter. Go to Windows Logs > Security
This article works for Windows 7,may or may not work for Windows Vista and Windows XP.
