Quick start with FileAudit

By the end of this guide, FileAudit is installed on a Windows Server and:

• one folder is audited, and every access to it is recorded

• file access events are visible in a report, with the user, the access type, and the time

• an email alert fires when a file in that folder is deleted

The whole guide works on a single test folder, C:\FileAudit-Test. None of your production shares are modified. Extending the audit to your real shares comes later, once you have seen the audit working end to end.

Allow about 15 minutes.

• Administrator rights on the machine that hosts the folder.
  FileAudit uses them to enable the Windows audit policy and to deploy the NTFS audit settings on the folder.

• A folder you can create and delete files in.
  Create C:\FileAudit-Test if you do not already have one.

• An SMTP server or relay, for the alert step only.
  The first four steps work without it.

We built this guide around a single test folder, so you can see FileAudit working before committing to a full deployment. Follow the six pages in order: each one ends where the next one begins.

1. Requirements: your server is confirmed able to run FileAudit and collect events.

2. Installing FileAudit: the service runs and the console is open on the dashboard.

3. Configuring your first audit path: the test folder is audited, and access to it is recorded.

4. Displaying the events: the recorded activity is visible in a report, filtered to your folder.

5. Setting up an alert: an email reaches you when a file in the folder is deleted.

6. Best practices: bonus step, beyond the 15 minutes. Your configuration is ready for real shares and for production.

If you would rather understand the product before installing it, these Reference pages cover the essentials:

• Windows audit: how FileAudit collects events from Windows file servers, and what it needs from the operating system.

• Access types: the operations FileAudit detects, from reads and writes to permission and ownership changes.

• Cloud audit: which cloud storage platforms can be audited alongside your Windows servers.

• Permissions and properties snapshots: how permission and ownership changes are tracked over time.

• Alerts: the two alert types, and what each one can be triggered on.

• Reporting: the available reports and what each one shows.