File server audit

Question

Hi all,
I need to audit company file servers.
In the company there are three file servers and domain users use them through DFS tecnology.

How can I audit file access, download file from file server and more?

Thanks
Federico

Answer 1

Hi，
Enable File and Folder auditing which can be done in two ways:
Through Group Policy (for Domains, Sites and Organizational Units)
Local Security policy (for single Servers)
Configure audit settings for File and Folders
This article will cover the process of enabling auditing for object access on a Windows Server 2012 through Group Policy.
reference：https://www.lepide.com/how-to/enable-file-folder-access-auditing-windows-server-2012.html
Tip: This answer contains the content of a third-party website. Microsoft makes no representations about the content of these websites. We provide this content only for your convenience.
Best wishes
Vicky

Answer 2

Something here may help.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder

you'll likely need to setup on each server's share.

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

Hello @Anonymous ,
Thanks for your reply.
I have seen that it is for Windows 10.
Is it the same on Windows Server 2016?

After that I have looked for this topic on the web.
I have seen that it is important set users (or group of users) that we want audit inside "Audit tab".
It is really common, in a file server, that exists a "main folder" and inside it, there are many shared folders.

Do you usually set audit for every single folders?

Thanks so much for your help!
Federico

Answer 4

Is it the same on Windows Server 2016?

Yes, the steps are the same.

Do you usually set audit for every single folders?

I wouldn't expect this normally. The simpler method would be to apply to this folder, subfolders and files at the top level folder structure.

--please don't forget to Accept as answer if the reply is helpful--

Answer 5

Dear @Anonymous ,
Thanks so much for your help.
I will try and I keep you updated.

Thanks
Federico