0

I wish to enable file system audit in Windows 7. Surprisingly, I've found that no audit events occurs, when folders are creating. There is events for folder/file deletion, for file creation, but no events for folder creation. I've checked it for 2 Windows 7, 1 Windows 2008 R2 and 1 Windows 2003 computers, there was same result. File system audit is enabled via Local Policy (gpedit.msc -> Local Computer Policy -> Windows Settings -> Security Settings -> Advanced audit policy configuration -> System audit policies - Local group policy object -> Object Access -> Audit file system: Success, Failure). Test folder audit is enabled too: events "Create files/Write Data", "Create folders/Append data", "Delete subfolders and files", "Delete" are checked both "Success" and "Failed" for "Everyone" group. Some articles say, that "Read Attributes" event should be enabled too for "Create Folders" event to be catched, but it has no effect for me (except "Read Attributes" events appear in Event Viewer). Any suggestions, please?

VlLight
  • 1
  • Is the auditing set in the folder above the target folder/file and set with 'Applies to: This folder, subfolder, and files'? Also, if I'm auditing file/folder access, I set it to Everyone and Full. – spacenomyous Nov 16 '18 at 18:51
  • It applies onto "This folder, subfolder, and files", and set for "Everyone" group. "Full" - do you mean "Full access" - all possible events enabled? I tried this, but had no events for folder creation. – VlLight Nov 16 '18 at 20:24

0 Answers0