1

I shared a folder created in my C drive with a colleague over the network and he was able to access it. Is there any log that will track this kind of activity? I am aware of Windows Security Event ID 5140: A network share object was accessed. Should this be on the workstation or will there be an AD authentication to the Domain controller to verify the person accessing it is actually the person whi is given permissions. Any thoughts will be appreciated.

1

You need to enable file auditing to accomplish this.

Locate the file or folder you want to audit in Windows Explorer.

Right-click the file or folder and then click Properties --> Security --> Advanced --> Auditing --> Edit --> Add

Enter the name of a user/group you want to audit for the selected file or folder, and click 'Check Names' to validate your entry. (You can use 'Everyone' too), --> OK

Select 'Success and Failure' next to Full control to audit everything for the selected file or folder

Click OK in each window until you are back at the Windows Explorer window and Repeat these steps for all files or folders you want to audit

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.