How do I audit within a given folder in Windows 10/11?


CSharpDev

Banned
Local time
6:04 PM
Posts
105
OS
Win11
I want to be able to see when, who made what changes to which file(s) in a given folder or subfolder

Can this be done natively or do I need a script for that? For example I have a NAS, one of the network shares contains all the 100 powershell scripts I have written and use extensively in my images, and I want to see when I made which / what changes to which script files preferably in the form of a table
 

My Computer

System One

  • OS
    Win11
I’m guessing from your handle that you’re a developer? Why aren’t these scripts under source control?
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 24H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical with Cherry MX Clears
    Antivirus
    Microsoft Defender
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical with Cherry MX Clears
In Windows, you can track file and folder changes natively by enabling native auditing. Here are the general steps to track changes to files and folders in Windows:

1. Enable 'Audit object access' policy:
- Launch the Group Policy Management console (Run --> gpedit.msc).
- Create a new GPO and link it to the domain containing the file server or edit the existing GPO.
- Navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Under Audit Policy, select 'Audit object access' and turn auditing on for both success and failure[2].

2. Edit auditing entry in the respective file/folder:
- Locate the file or folder for which you wish to track all the accesses.
- Right-click on it and go to Properties.
- Under the Security tab, click Advanced.
- In Advanced Security Settings, go to the Auditing tab and add the entries for the specific types of access you want to audit[2].

Once auditing is enabled, Windows will document all access and modification events in the security event log[3]. Additionally, third-party tools like ADAudit Plus offer more detailed auditing information and real-time alerts for file and folder changes[2].

These steps allow you to track who made what changes to which file(s) in a given folder or subfolder natively in Windows.
 

My Computer

System One

  • OS
    Win 11 Enterprise
    Computer type
    Laptop
To perform auditing, you will want to go to Properties > Security > Advanced > Auditing. Select items to audit judiciously as you can easy generate hundreds of messages per second on a busy system depending upon what you audit!

Image1.jpg
 

My Computers

System One System Two

  • OS
    Win11 Pro 24H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self-built
    CPU
    Intel i7 11700K
    Motherboard
    ASUS Prime Z590-A MB
    Memory
    64GB (Waiting for warranty replacement of another 64GB for 128GB total)
    Graphics Card(s)
    No GPU - Built-in Intel Graphics
    Sound Card
    Integrated
    Monitor(s) Displays
    HP Envy 32
    Screen Resolution
    2560 x 1440
    Hard Drives
    1 x 1TB NVMe SSD
    1 x 2TB NVMe SSD
    1 x 4TB NVMe SSD
    3 x 512GB 2.5" SSD
    1 x 4TB 2.5" SSD
    5 x 8TB Seagate Barracuda HDD
    PSU
    Corsair HX850i
    Case
    Corsair iCUE RGB 5000X mid tower case
    Cooling
    Noctua NF-S12A chromax.black.swap case fans (Qty. 7) & Home Computer Specifications, Configuration, and Usage Notes General Specifications ASUS Prime Z590-A motherboard, serial number M1M0KC222467ARP Intel Core i7-11700K CPU (11th Gen Rocket Lake / LGA 1200 Socket) 128GB Crucial Ballistix RGB DDR4 3200 MHz DRAM (4 x 32GB) Corsair iCUE RGB 5000X mid tower case Noctua NH-D15 chromax.black CPU cooler Noctua NF-S12A chromax.black.swap case fans (Qty. 7) & Corsair LL-120 RGB Fans (Qty. 3)
    Keyboard
    Corsair K70 Max RGB Magnetic Keyboard
    Mouse
    Logitech MX Master 3
    Internet Speed
    1Gb Up / 1 Gb Down
    Browser
    Edge
    Antivirus
    Windows Defender
    Other Info
    The five 8TB drives and three 512GB SSDs are part of a DrivePool using StableBit DrivePool software. The three SSDs are devoted purely to caching for the 8TB drives. All of the important data is stored in triplicate so that I can withstand simultaneous failure of 2 disks.

    Networking: 2.5Gbps Ethernet and WiFi 6e
  • Operating System
    Win11 Pro 23H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo ThinkBook 13x Gen 2
    CPU
    Intel i7-1255U
    Memory
    16 GB
    Graphics card(s)
    Intel Iris Xe Graphics
    Sound Card
    Realtek® ALC3306-CG codec
    Monitor(s) Displays
    13.3-inch IPS Display
    Screen Resolution
    WQXGA (2560 x 1600)
    Hard Drives
    2 TB 4 x 4 NVMe SSD
    PSU
    USB-C / Thunderbolt 4 Power / Charging
    Mouse
    Buttonless Glass Precision Touchpad
    Keyboard
    Backlit, spill resistant keyboard
    Internet Speed
    1Gb Up / 1Gb Down
    Browser
    Edge
    Antivirus
    Windows Defender
    Other Info
    WiFi 6e / Bluetooth 5.1 / Facial Recognition / Fingerprint Sensor / ToF (Time of Flight) Human Presence Sensor
@CSharpDev
You got a good answer from @pseymour, just put your scripts into a source control and you'll see all modifications including your own.
GitHub allows you to create private repository so you can keep your scripts online while not putting them on public display, nobody will be able to see or download them, except people you allow if you want.

And on top of that you can protect your account with 2FA so your scripts stay secured with your phone, you can't get anything better than that.
 

My Computer

System One

  • OS
    Windows 11 Pro 23H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI / MS-7B29
    CPU
    Intel i3 8100 @3.6Ghz
    Motherboard
    H310M PRO-VDH (MS-7B29)
    Memory
    1 x 16GB DDR4 @2400 MHz
    Graphics Card(s)
    Nvidia GeForce GT 1030 2GB SDDR4
    Sound Card
    Realtek VEN_10EC&DEV_0887 / NVIDIA VEN_10DE&DEV_0081
    Monitor(s) Displays
    Acer V226HQL
    Screen Resolution
    1920 x 1080
    Hard Drives
    SSD 500 GB Crucial MX500 / HDD 1 TB TOSHIBA DT01ACA100
    PSU
    ATX, details unknown
    Case
    Everest 551B
    Cooling
    details unknown
    Keyboard
    Mechanical Gaming Hydra R7 - Rampage
    Mouse
    Logitech G703
    Internet Speed
    Down: 28Mbps / Up: 19Mbps
    Browser
    Microsoft Edge
    Antivirus
    Microsoft Defender Antivirus
    Other Info
    Bluetooth: TP Link 5.0 Nano USB adapter UB500
    WLAN: D-Link 150 Pico USB adapter, N standard
    Web camera: Logitech C270 HD 720p @30fps
    Microphone: Trust MICO, model 23790
Back
Top Bottom