Track files open

Download Lepide File Server Auditor. In This Article. Here are the steps to track who read a file on Windows File Server. Note: It is suggested to create a new GPO, link it to the domain, and edit it.

The former lets you audit successful attempts made to access the objects, whereas the latter lets you audit failed attempts. Select any one or both the options as per requirement. It is recommended to select both options. In our case, we have selected both the options because we want to audit both the successful and the failed attempts. Step 2 — Set auditing on the files that you want to track After configuring GPO, you have to set auditing on each file individually, or on folders that contain the files.

In order to make it easier to look through so many events, you can put a filter and just see the important stuff. Click on the View menu at the top and click on Filter. If there is no option for Filter, then right-click on the Security log in the left-hand page and choose Filter Current Log. In the Event ID box, type in the number This is the event associated with a particular user performing a File System action and will give you the relevant information without having to look through thousands of entries.

In the example above, the file worked on was New Text Document. What I did here was delete the file. As you read through this, you can see I accessed Address Labels. In this case, I simply opened the file using Word. I suggest creating a test folder with files and performing various actions to see what shows up in the Event Viewer.

Founder of Online Tech Tips and managing editor. He began blogging in and quit his job in to blog full-time. He has over 15 years of industry experience in IT and holds several technical certifications. Read Aseem's Full Bio. We hate spam too, unsubscribe at any time. Table of Contents. Unlike Native Auditing, you do not have to manually enable the auditing for different files and folders.

You just have to install the solution, configure the audit settings once and you are good to go. The following image shows the files and folders creation report. You can filter the records by any column; including file name, creation time, user name and any other available column. All the necessary information related to the create event is shown in a single line record.

In the above image, we have highlighted the record which contains the information about where a file was created. In this article, you have seen how to keep track of all files and folders activities on your Windows File Server using both native methods and Lepide File Server Auditor. Download Lepide File Server Auditor.