File server audit

Question

Hi all,
I need to audit company file servers.
In the company there are three file servers and domain users use them through DFS tecnology.

How can I audit file access, download file from file server and more?

Thanks
Federico

Answer 1

Hi，
Enable File and Folder auditing which can be done in two ways:
Through Group Policy (for Domains, Sites and Organizational Units)
Local Security policy (for single Servers)
Configure audit settings for File and Folders
This article will cover the process of enabling auditing for object access on a Windows Server 2012 through Group Policy.
reference：https://www.lepide.com/how-to/enable-file-folder-access-auditing-windows-server-2012.html
Tip: This answer contains the content of a third-party website. Microsoft makes no representations about the content of these websites. We provide this content only for your convenience.
Best wishes
Vicky

Answer 2

Hi @Anonymous ,
I have tried to configure file system audit on just the first file server inside DFS company.

First of all, I have created a Domain Group Policy too. Here an example guide: https://www.varonis.com/blog/windows-file-system-auditing/

Later I have done your suggested steps.
I have edited "shares" folder. Inside this main folders (this folder is not shared) there are inside shared company folders.
I have set "Authenticated Users" and "Full Control" inside auditing tab.

Here there are photos about this task:

I have three file servers. Is it possible done this task just one time at DFS level?

After that I have found important event id such as (you can see them using EventViewer > Security):

• 4660 --> file deleted
• 4663 --> file opened

Finally, always from GPO settings (Computer configuration > Policies > Windows Settings > Security settings > Advanced Audit Policy Configuration > Object Access) I have found three more audit settings about file system and file share.

Thanks so much for your help

Answer 3

I have three file servers. Is it possible done this task just one time at DFS level?

Unfortunately you'll need to set it up on all three servers. We can't audit the namespace itself.

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

Dear @Anonymous ,
Thanks for your help!

Federico