---
locale: "en"
updated_at: "2026-08-06T09:08:44.155Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/getting-started/quick-start"
---

# Quick start with FileAudit

What the setup involves, what to prepare, and the order to work through it.

## What you set up in this guide

By the end of this guide, FileAudit is installed on a Windows Server and:

- one folder is audited, and every access to it is recorded
- file access events are visible in a report, with the user, the access type, and the time
- an email alert fires when a file in that folder is deleted

The whole guide works on a single test folder, `C:\FileAudit-Test`. None of your production shares are modified. Extending the audit to your real shares comes later, once you have seen the audit working end to end.

Allow about 15 minutes.

## What to have ready before you start

- **Administrator rights** on the machine that hosts the folder. 
FileAudit uses them to enable the Windows audit policy and to deploy the NTFS audit settings on the folder.
- **A folder you can create and delete files in.** 
Create `C:\FileAudit-Test` if you do not already have one.
- **An SMTP server or relay**, for the alert step only. 
The first four steps work without it.

> **Note**
>
> Operating system versions, .NET, database options, ports and services are listed in [Requirements](/fileaudit/docs/getting-started/requirements) Getting started.

## The Getting started guide in six steps

We built this guide around a single test folder, so you can see FileAudit working before committing to a full deployment. Follow the six pages in order: each one ends where the next one begins.

1. [Requirements](/fileaudit/docs/getting-started/requirements): your server is confirmed able to run FileAudit and collect events.
2. [Installing FileAudit](/fileaudit/docs/getting-started/installation): the service runs and the console is open on the dashboard.
3. [Configuring your first audit path](/fileaudit/docs/getting-started/configuring-your-first-audit-path): the test folder is audited, and access to it is recorded.
4. [Displaying the events](/fileaudit/docs/getting-started/displaying-events): the recorded activity is visible in a report, filtered to your folder.
5. [Setting up an alert](/fileaudit/docs/getting-started/setting-up-an-alert): an email reaches you when a file in the folder is deleted.
6. [Best practices](/fileaudit/docs/getting-started/best-practices): bonus step, beyond the 15 minutes. Your configuration is ready for real shares and for production.

## How FileAudit works and what it can audit

If you would rather understand the product before installing it, these Reference pages cover the essentials: 

- [Windows audit](/fileaudit/docs/reference/core-concepts/windows-audit): how FileAudit collects events from Windows file servers, and what it needs from the operating system.
- [Access types](/fileaudit/docs/reference/core-concepts/access-types): the operations FileAudit detects, from reads and writes to permission and ownership changes.
- [Cloud audit](/fileaudit/docs/reference/core-concepts/cloud-audit): which cloud storage platforms can be audited alongside your Windows servers.
- [Permissions and properties snapshots](/fileaudit/docs/reference/core-concepts/permissions-properties-snapshots): how permission and ownership changes are tracked over time.
- [Alerts](/fileaudit/docs/reference/alerts): the two alert types, and what each one can be triggered on.
- [Reporting](/fileaudit/docs/reference/reporting): the available reports and what each one shows.