How do I audit within a given folder in Windows 10/11?


CSharpDev

Banned
Local time
4:59 AM
Posts
105
OS
Win11
I want to be able to see when, who made what changes to which file(s) in a given folder or subfolder

Can this be done natively or do I need a script for that? For example I have a NAS, one of the network shares contains all the 100 powershell scripts I have written and use extensively in my images, and I want to see when I made which / what changes to which script files preferably in the form of a table
 

My Computer My Computer

At a glance

Win11
OS
Win11
I’m guessing from your handle that you’re a developer? Why aren’t these scripts under source control?
 

My Computer My Computer

At a glance

Windows 11 Pro 25H212th Gen Core i7-1260P64 GB Micron PC4-25600Intel Iris Xe Graphics
OS
Windows 11 Pro 25H2
Computer type
PC/Desktop
Manufacturer/Model
Intel NUC12WSHi7
CPU
12th Gen Core i7-1260P
Motherboard
NUC12WSBi7
Memory
64 GB Micron PC4-25600
Graphics Card(s)
Intel Iris Xe Graphics
Sound Card
on-board Realtek HD Audio
Monitor(s) Displays
Dell U3219Q
Screen Resolution
3840 x 2160
Hard Drives
Samsung SSD 990 PRO 1TB
Crucial MX500 2 TB
Antivirus
Microsoft Defender
In Windows, you can track file and folder changes natively by enabling native auditing. Here are the general steps to track changes to files and folders in Windows:

1. Enable 'Audit object access' policy:
- Launch the Group Policy Management console (Run --> gpedit.msc).
- Create a new GPO and link it to the domain containing the file server or edit the existing GPO.
- Navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Under Audit Policy, select 'Audit object access' and turn auditing on for both success and failure[2].

2. Edit auditing entry in the respective file/folder:
- Locate the file or folder for which you wish to track all the accesses.
- Right-click on it and go to Properties.
- Under the Security tab, click Advanced.
- In Advanced Security Settings, go to the Auditing tab and add the entries for the specific types of access you want to audit[2].

Once auditing is enabled, Windows will document all access and modification events in the security event log[3]. Additionally, third-party tools like ADAudit Plus offer more detailed auditing information and real-time alerts for file and folder changes[2].

These steps allow you to track who made what changes to which file(s) in a given folder or subfolder natively in Windows.
 

My Computer My Computer

At a glance

Win 11 Enterprise
OS
Win 11 Enterprise
Computer type
Laptop
To perform auditing, you will want to go to Properties > Security > Advanced > Auditing. Select items to audit judiciously as you can easy generate hundreds of messages per second on a busy system depending upon what you audit!

Image1.jpg
 

My Computers My Computers

  • At a glance

    Win11 Pro 25H2 (RTM+)Intel i7-14650HX32 GBNo GPU - Built-in Intel Graphics
    OS
    Win11 Pro 25H2 (RTM+)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Acemagic
    CPU
    Intel i7-14650HX
    Memory
    32 GB
    Graphics Card(s)
    No GPU - Built-in Intel Graphics
    Sound Card
    Integrated
    Monitor(s) Displays
    Varies as machine will often be moved to locations with different monitors
    Screen Resolution
    Varies
    Hard Drives
    1 x 1TB Gen 4 NVMe SSD
    PSU
    120W Power Brick
    Keyboard
    Corsair K70 Max RGB Magnetic Keyboard
    Mouse
    Logitech MX Master 3
    Internet Speed
    1Gb Up / 1 Gb Down
    Browser
    Edge
    Antivirus
    Windows Defender
  • At a glance

    Win11 Pro 25H2 (RTM+)Intel i7-1255U16 GBIntel Iris Xe Graphics
    Operating System
    Win11 Pro 25H2 (RTM+)
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo ThinkBook 13x Gen 2
    CPU
    Intel i7-1255U
    Memory
    16 GB
    Graphics card(s)
    Intel Iris Xe Graphics
    Sound Card
    Realtek® ALC3306-CG codec
    Monitor(s) Displays
    13.3-inch IPS Display
    Screen Resolution
    WQXGA (2560 x 1600)
    Hard Drives
    2 TB 4 x 4 NVMe SSD
    PSU
    USB-C / Thunderbolt 4 Power / Charging
    Keyboard
    Backlit, spill resistant keyboard
    Mouse
    Buttonless Glass Precision Touchpad
    Internet Speed
    1Gb Up / 1Gb Down
    Browser
    Edge
    Antivirus
    Windows Defender
    Other Info
    WiFi 6e / Bluetooth 5.1 / Facial Recognition / Fingerprint Sensor / ToF (Time of Flight) Human Presence Sensor
@CSharpDev
You got a good answer from @pseymour, just put your scripts into a source control and you'll see all modifications including your own.
GitHub allows you to create private repository so you can keep your scripts online while not putting them on public display, nobody will be able to see or download them, except people you allow if you want.

And on top of that you can protect your account with 2FA so your scripts stay secured with your phone, you can't get anything better than that.
 

My Computer My Computer

At a glance

Windows 11 Pro 23H2Intel i3 8100 @3.6Ghz1 x 16GB DDR4 @2400 MHzNvidia GeForce GT 1030 2GB SDDR4
OS
Windows 11 Pro 23H2
Computer type
PC/Desktop
Manufacturer/Model
MSI / MS-7B29
CPU
Intel i3 8100 @3.6Ghz
Motherboard
H310M PRO-VDH (MS-7B29)
Memory
1 x 16GB DDR4 @2400 MHz
Graphics Card(s)
Nvidia GeForce GT 1030 2GB SDDR4
Sound Card
Realtek VEN_10EC&DEV_0887 / NVIDIA VEN_10DE&DEV_0081
Monitor(s) Displays
Acer V226HQL
Screen Resolution
1920 x 1080
Hard Drives
SSD 500 GB Crucial MX500 / HDD 1 TB TOSHIBA DT01ACA100
PSU
ATX, details unknown
Case
Everest 551B
Cooling
details unknown
Keyboard
Mechanical Gaming Hydra R7 - Rampage
Mouse
Logitech G703
Internet Speed
Down: 28Mbps / Up: 19Mbps
Browser
Microsoft Edge
Antivirus
Microsoft Defender Antivirus
Other Info
Bluetooth: TP Link 5.0 Nano USB adapter UB500
WLAN: D-Link 150 Pico USB adapter, N standard
Web camera: Logitech C270 HD 720p @30fps
Microphone: Trust MICO, model 23790

Latest Support Threads

Back
Top Bottom