Skip to main content

Track file history (open,edit,delete) in Windows Event Viewer

When working on computer, files and folders are very important for you works. So that, we always want to know it history. When/Who have files/folders opened or edited or deleted??? Now we will show you how to do that by using Event Viewer.
Track file history (open,edit,delete) in Windows Event Viewer

  1. Config "Local Group Policy": 
    • Click Start > Run, input "gpedit.msc" and hit enter.
    • In Local Group Policy, browse to "Computer Congfiguration > Windows Settings > Security Settings > Local Policies > Audit Policy". Then open "Audit object access".
    • In "Audit object access" properties dialog, check all at Audit these attempts options: "Success" and "Failure". Click OK.
  2. Config "File/Folder Property":
    • Right click on your file/folder and choose Properties. Browse to "Security > Advanced > Auditing > Edit".
    • In opened dialog, click  Add and choose user account to follow. Click OK.
    • Now, check on what actions you want to record history. Example: Delete, Delete subfolders and files...
    • Click OK to save your settings.
  3. Using Windows Event Viewer to view when/who were your files/folders modified:
    • Click "Start > All Programs > Administrative Tools > Event Viewers"
    • In Event Viewer windows, browse to "Windows logs > Security". Read events with "File system" category to see what were occur with your files/folders.
That's all. Wish succeed!
Video guide here:



Comments

Popular posts from this blog

Fix network printer error 0x0000709

When printing in the network, sometimes you see the error "Operation could not be completed (error 0x00000709). Double click the printer name and make sure that the printer is connected to the network".  Here we show how to fix the error: Open Windows Control Panel Open Credential Manager Choose Windows Credentials Click Add a Windows credential Internet or network address: input the computer name which share the printer User name: input "guest" Password: leave it blank Then click OK and reconnect the shared printer Do not need: uninstall Windows updates; change Windows registry... This maybe applied for error: 0x00000005, 0x0000011b... Watch the step by step video on here: