When working on computer, files and folders are very important for you works. So that, we always want to know it history. When/Who have files/folders opened or edited or deleted??? Now we will show you how to do that by using Event Viewer.
- Config "Local Group Policy":
- Click Start > Run, input "gpedit.msc" and hit enter.
- In Local Group Policy, browse to "Computer Congfiguration > Windows Settings > Security Settings > Local Policies > Audit Policy". Then open "Audit object access".
- In "Audit object access" properties dialog, check all at Audit these attempts options: "Success" and "Failure". Click OK.
- Config "File/Folder Property":
- Right click on your file/folder and choose Properties. Browse to "Security > Advanced > Auditing > Edit".
- In opened dialog, click Add and choose user account to follow. Click OK.
- Now, check on what actions you want to record history. Example: Delete, Delete subfolders and files...
- Click OK to save your settings.
- Using Windows Event Viewer to view when/who were your files/folders modified:
- Click "Start > All Programs > Administrative Tools > Event Viewers"
- In Event Viewer windows, browse to "Windows logs > Security". Read events with "File system" category to see what were occur with your files/folders.
That's all. Wish succeed!
Video guide here:
Comments
Post a Comment