---
locale: "en"
updated_at: "2026-07-30T14:08:56.142Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/getting-started/configuring-your-first-audit-path"
---

# Configuring your first audit path

Add your first Windows path in FileAudit to start recording and storing every file access event.

## Before you begin

FileAudit must be [installed](/fileaudit/docs/getting-started/installation) and you must be able to open the FileAudit console.

Configuring a path switches on Windows auditing behind the scenes, so FileAudit needs **administrator rights** on the machine that hosts the folder. FileAudit uses them to enable the Windows Audit Object Access policy and to deploy the NTFS audit settings (SACL) on the folder, at steps 6 to 8 below.

An audit path is a **single file or folder** you ask FileAudit to watch. Once a path is configured, FileAudit records who accessed it, when, and how, and stores every event in its database.

In this example you will audit a test folder named `C:\FileAudit-Test`. Create it first if it does not already exist.

At each step of the wizard you can let FileAudit apply a setting automatically or handle it yourself. For your first path, accept the automatic option at every step. It is the recommended configuration and the fastest way to a working audit.

## Add a Windows path to audit

1. Open the FileAudit console.
2. Go to **Windows paths**.
3. Click on **Add a path**.
  ![Add a path](https://a.storyblok.com/f/122374/1298x826/354cf7d172/configure-a-path.png)
4. Select the path `C:\FileAudit-Test`.
5. Click on **Next** and  keep the default audit settings.
Please note that FileAudit will automatically enable the required Windows auditing settings.
  ![File / folder audit configuration wizard](https://a.storyblok.com/f/122374/1288x817/90ba5c242c/warnings-audit-configuration-path.png)
6. Select whether FileAudit should **automatically **enable the "**Windows Audit Object Access**" **policy** or assume it is already configured.
  ![Enable the object access audit](https://a.storyblok.com/f/122374/766x705/0db5cb2c91/enable-object-access-audit.png)
7. Select whether FileAudit should automatically configure** NTFS auditing **(SACL deployment) on the file or folder, or assume it is already configured.
  ![Configure the NTFS audit on the file/folder](https://a.storyblok.com/f/122374/766x705/f8e5c27f8f/configure-ntfs-audit-file-folder.png)
8. Choose how **NTFS audit inheritance** is handled by FileAudit.
  ![Enable the inheritance of the NTFS Audit settings](https://a.storyblok.com/f/122374/766x705/698497bab0/enable-inheritance-ntfs-audit.png)
9. The folder host will be added to the ‘Licensed servers’ list.
  ![FileAudit path wizard License](https://a.storyblok.com/f/122374/766x705/90d8175bea/fileaudit-path-wizard-license.png)
10. **Enable **real-time event monitoring.
  ![Schedule FileAudit for this server](https://a.storyblok.com/f/122374/766x705/d86e5f39e9/schedule-fileaudit-server.png)
11. Your path is now configured. It appears in the **Windows paths** list, and FileAudit records every access event on `C:\FileAudit-Test` and stores it in its database.

> **Note**
>
> 💡 **Tip**: A path can be added by right-clicking a file or folder in Windows Explorer and selecting FileAudit from the context menu, or entered manually using filters in reporting views.

## Next step

Continue the scenario in [Displaying the events](/fileaudit/docs/getting-started/displaying-the-events) to open the **All access events** report and see the activity FileAudit is now recording on `C:\FileAudit-Test`.