FileAudit^® FAQ

• How do I start FileAudit?
• Why can't I see any accesses in the FileAudit dialog box?
• FileAudit was working just after I installed it but now I don’t see any new file accesses. What’s the problem?
• I only see two days of audit. How can I keep older file accesses?
• Why do I get 'Error Code: 00000005' when trying to audit a file or folder?

How do I start FileAudit?

FileAudit is not a program by itself but an extension to the Windows explorer. To start it, select some files or folders to audit, right-click on them and select the FileAudit menu.

Why can't I see any accesses in the FileAudit dialog box?

- FileAudit searches the Audit information in the Windows NT event logs. In order to use FileAudit, you need to enable the Audit in your domain by checking the appropriate checkboxes in the User Manager for Domains (Windows NT 4) or in Local security policy console (Windows 2000). Also, you will need to specify which accesses should be audited in the NTFS settings of the audited files and directories.

FileAudit was working just after I installed it but now I don’t see any new file accesses. What’s the problem?

Check the configuration of your security log. Overwrite events as needed should be selected to avoid that the system doesn't generate the audit events when the log is full.

I only see two days of audit. How can I keep older file accesses?

If you are using FileAudit 2.x you need to increase the size of your security log so the system will keep the audit events for a longer time. With FileAudit 3 all file access events are stored in a database so you should not have this problem.

Why do I get 'Error Code: 00000005' when trying to audit a file or folder?

The account you are using hasn't got administrative rights on the selected file or folder