Then configure the Maximum log size (KB) and the action to be taken if the maximum event log size is reached. Navigate to the properties of the Security log on the target Windows file server.Then force the file servers to check the new group policy: Right-click the OU in Group Policy Management again, click Group Policy Update and follow the steps in the wizard. In Group Policy Management, right-click the OU, select Link an existing GPO…, select the GPO we created (File System Access Policy) and click OK to apply it to the selected OU. Now we need to link the new GPO with the OU that contains the file servers.

Select Configure the following audit events and choose both Success and Failure.

Double-click Audit Handle Manipulation.

Save your changes by clicking Apply and then click OK. Then select Configure the following audit events and choose both Success and Failure.

Navigate to Computer Configuration –> Windows Settings –> Advanced Audit Policy Configuration –> Audit Policies –> Object Access.

Right-click the new GPO to launch the Group Policy Management Editor window.

Create a new Group Policy object (GPO) through Group Policy Management and enter a suitable name.Audit Handle Manipulation - Adds visibility into failed access attempts.Audit File System - Audits user attempts to access file system objects.In this example, we will enable the following options: In particular, when it comes to auditing file access, basic audit policy provides a single setting while advanced policy provides 14 subcategories. (If you have just a single file server, you could use Local Security Policy instead.)Īdvanced audit policy allows administrators to be more selective in the types and number of events to be returned than they can with the basic audit policy settings. In this blogpost, I will show how to enable an advanced audit policy through Group Policy on a domain controller running Windows Server 2016 R2. Configuring File Access Auditing on a Windows File Server

Sysinternals file access monitor