Monitor And Track When And Who Accessed A Folder On Your Computer
Are you suspicious that your important files and folders are being accessed by some other user on your computer? If yes, then there is a small handy feature built into Windows which you can use to find out who and when either using your account or some one else’s account on your computer has accessed a particular folder or a file. This feature is a part of Group Policy Editor which is used mostly for advances system settings and is a Graphical User interface ( GUI ) of a set of registry settings. Read on to find out how to make it monitor and track the folders.
To get to the policy editor, click on Start and then on Run command type gpedit.msc.
Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
Double-click on the Audit Object Access setting and check both Success and Failure as shown in the screenshot below, so that Windows may know that we want to monitor and track the folder and file access.
Open Windows Explorer and navigate to the folder you want windows to keep track of. Right click the folder and select Properties, on the Security tab you will find these options shown in the screenshot.
From here click on the Advanced button and click on the Auditing tab. When you’ll select the Add button a dialog box will appear asking you to select a user or a group, just type in “users” and click Check names.
Now click OK and you’ll get a dialog box to select what you want to watch for this folder, just select the Full control option to keep a log of everything in the log file.
Now you are finished setting the auditing folder, its time to see the actual events, to view the events, go to Control Panel and click on Administrative Tools, launch the Event Viewer and click on the security tab and you’ll see a large listing of events.
If you have multiple users in your account, then you can you can look through the entries to find out who accessed your particular folder, In order to make things easier click on the View menu and select Filter and type 560 in the Event ID box that will filter the events associated with particular user.
To get more information about a particular event, double click on it to find everything about who and when someone accessed the folder you applied to generate event logs.
This process might be tedious for novice users but is an exceptional method for monitoring folder for administrators, if you have any queries do let us know !
When I get to the folder and right click I do not have security tab… my 3 tabs are: General, Sharing and customize…. Can you tell me why I dont have that tab? yes I did the audit thing and it is set and rechecked it and it is still set to success failure both checked…
by the way I have a 64bit computer could that be why???
@Daps
I think you need to have the drives File system as NTFS for this.
You can check this by right click on the drive -> click properties and look for the value “File System”
Thanks Asad for the great tip. I hate to use third party softwares, thus this tip seems really helpful.