#Windows 10 file copy log windows#

Open up File Explorer and look to the left-side column for “ Desktop” and right-click it to select “ Properties.” Navigate to the “ Security” tab and select “ Advanced” near the bottom as shown below.įrom here, go to the “ A uditing” tab and select “ Add” near the bottom. For clients, usually this would entail shared drives, directories where important files are stored, and situation-specific folders.įor this example, I have decided to target my Desktop.

#Windows 10 file copy log windows#

Enabling the File & Folder Access Security AuditĮven though we enabled Event ID 4663 though activating the Audit Object Access Policy, Windows still requires that you individually specify what directories and files you want this policy to target. Now, you need to specify what on your machine you want to monitor. You now have the appropriate auditing policy active on your machine. Right-click “ Audit Object Access” and click “ Properties.” Then check the two boxes listed for both “ Success” and “ Failure,” and click Apply and OK. You should now see the following screen, showing all available policies within the auditing category we just selected. When open, look at the left-side column and navigate to Local Policies –> Audit Policy. Go ahead and type in your Windows search bar “ Local Security Policy” and open the associated application. To get these logs to appear, we next need to edit our local policy. If it does not, and you are seeing log results, then congratulations! You are already gathering the logs necessary to do simple file and folder auditing.įor the less fortunate readers, you are stuck with me for now.

After, look to the far right pane for “ Filter Current Log,” and then filter by “ 4663” as shown below. Then navigate to Windows Logs –> Security.

Local Security Policies are also sometimes referred to as Local Group Policy Objects.įor the sake of clarity, first navigate to Event Viewer. RequirementsĪdjusting the Local Security Policy on a machine is essentially the same as adjusting Group Policy the former is local (pertaining to one endpoint) while the latter is global (pertaining to “all” endpoints). This post talks about the steps to enable this process, and the benefits that come with seeing these new logs. However, for the purpose of this post we will be dealing with one specific endpoint, so we will be adjusting the Local Security Policy on the machine instead. When dealing with multiple endpoints, like multiple file servers, creating a GPO would be the right way to go. To see this log, you need an Administrator to change the Local Security Policy on the machine OR create a new Group Policy Object (GPO) for file auditing.

However, this Event ID is not enabled by default. 😦Īfter some preliminary research, I was able to determine that a Security log in Windows Event Viewer with Event ID 4663 had exactly what I was looking for. They can be either deleted by the system or modified purposely or unknowingly by a user, and if you have no record of where they went you may find yourself struggling to find it again, praying to the Cybergods for mercy. These instances vary per client, however mostly center around files and folders that are seen in our logs but are no longer in the directory identified. Working as a SOC Analyst for the summer, I’ve stumbled across a plethora of instances in which my coworkers and I would have benefited from a history of previous file and folder modifications.