How Can I See Who Accessed or Modified a File or Folder in Windows?

Windows can record who opened, accessed, changed, or deleted a file or folder but only if auditing was enabled before the activity occurred.

I put together a step-by-step guide covering:

• How to enable file system auditing
• How to configure auditing for a specific file or folder
• Which Security log Event IDs to check: 4656, 4663, 4660, and 4670
• How to identify the account, action, file or folder path, and timestamp
• Why native auditing becomes difficult across multiple file servers
• How centralized file server auditing tools can simplify investigations

One important limitation: Windows does not retroactively create file or folder access records. If auditing wasn’t already configured, you generally can’t use native logs to determine who previously accessed or modified a file or folder.

The article also discusses Lepide as an alternative for centralized reporting and real-time alerts, so full disclosure: it includes our product.

Article: https://www.lepide.com/how-to/find-who-accessed-or-modified-a-file-or-folder-in-windows.html

How do you currently track file and folder activity on Windows file servers: native auditing, a SIEM, or another tool?