How to Track File/Folder Creation and Deletion in Windows

Tracking file and folder changes in Windows is crucial for various reasons, including:

• Security Auditing: Monitoring user activity and identifying potential security breaches.
• Data Recovery: Restoring deleted files or recovering lost data.
• Compliance: Meeting regulatory requirements that mandate the tracking of file system activity.
• Troubleshooting: Identifying the source of file conflicts or unexpected changes.

Methods for Tracking File and Folder Changes

1. File System Auditing:

   • How it Works: Configures detailed auditing rules for specific files or folders.

   • Step 1: Enable Audit Object Access

     1. Open Local Security Policy:
        • Press Win + R, type secpol.msc, and press Enter.
     2. Navigate to Security Settings > Local Policies > Audit Policy.
     3. Double-click Audit Object Access and select Success and Failure.
     4. Click OK to save changes.

     Step 2: Configure File/Folder Auditing

     1. Right-click the file or folder you want to monitor and select Properties.
     2. Go to the Security tab and click Advanced.
     3. Switch to the Auditing tab and click Add.
     4. Click Select a Principal, type Everyone, and press OK.
     5. In the Auditing Entry window:
        • Select Success and Failure.
        • Check Create files/Write data, Delete subfolders and files, and Delete.
     6. Click OK to apply settings.
      
   • Limitations:
     • Can significantly impact system performance if overused.
     • Requires careful configuration to avoid excessive log data.

2. Track Changes in Event Viewer

   • How it Works: Leverages the built-in Event Viewer to record system events, including file system changes.
   • Key Event IDs:
     • 4663 (Object Access): Provides information about various file and folder access operations, including creation, deletion, modification, and more.
     • 4656 (Handle Created): Indicates that an access handle to an object was requested.
   • Limitations:
     • Can generate a large volume of log data.
     • Requires manual filtering and analysis.

3. PowerShell:

   • How it Works: Utilizes the Get-WinEvent cmdlet to dynamically filter and retrieve security logs related to file system events.

   • **Example:**PowerShell

     Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4663} | Format-Table TimeCreated, Message -AutoSize

   • Benefits:

     • Provides flexibility and automation for log analysis.
     • Can be integrated into scripts for regular monitoring.

4. Third-Party Tools:

   • How it Works: Specialized tools offer advanced features like real-time monitoring, detailed reporting, and alerts.
   • Examples:
     • FileAudit: Comprehensive tracking and alerts for file changes.
     • Netwrix Auditor: Detailed audit reports for file and folder access.
     • ManageEngine ADAudit Plus: Advanced file and folder auditing and reporting.

Best Practices:

• Minimize Performance Impact: Configure auditing rules carefully to avoid excessive log data and minimize the impact on system performance.
• Regularly Review Logs: Regularly analyze event logs to identify and address any suspicious activity.
• Implement Security Measures: Protect audit logs from unauthorized access to maintain the integrity of the auditing process.
• Consider Compliance Requirements: Ensure that your auditing practices comply with relevant regulations and industry standards.

Relevant Articles

• Microsoft's Doc: Apply a basic audit policy on a file or folder
• How to Track Group Policy Changes
• How to Check Active Directory (AD) Event Logs
• How to Track File or Folder Changes in Windows