Audit Files and Folder

MPEG 336 Reputation points
2021-03-26T08:39:22.01+00:00

Hi, How can I audit on one of my File Server who has delete or edit create files or directory? I am using SCOM 2019 server. Regards

Operations Manager
Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,413 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. AlexZhu-MSFT 5,551 Reputation points Microsoft Vendor
    2021-03-29T01:11:57.757+00:00

    Hi,

    To achieve this, we need to 1) enable file system auditing for the target computers; 2) crate a monitor/rule based on the specific Event ID generated above. For the step-by-step guide, we may refer to:

    https://www.varonis.com/blog/windows-file-system-auditing/

    https://infrontconsulting.asia/scom-create-monitor-based-on-event-viewer-log/

    Note: the above articles are not from MS, just for your reference.

    Regards,

    Alex
    If the response is helpful, please click "Accept Answer" and upvote it.

    0 comments
  2. System Center guy 686 Reputation points
    2021-03-29T02:03:10.417+00:00

    May be consider using MARTELLO SCOM Files and Folders Monitoring Management Pack
    https://martellotech.com/downloads/mp-scom-files-folders-monitoring/

    Roger

    0 comments