---
locale: "en"
updated_at: "2026-07-31T09:51:42.028Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/getting-started/requirements"
---

# Requirements

Hardware, software, and network prerequisites for running FileAudit.

## System requirements

Meet these hardware, software, and database requirements before installing FileAudit.

| Requirement | Details |
| --- | --- |
| **Operating system** | Windows Server 2012 R2 or later, Windows 8.1 or later |
| **.NET Framework** | .NET Framework 4 required |
| **Database** | - SQLite (default, included), - Microsoft SQL Server 2008+, - SQL Server Express 2008+, - MySQL 5.6+, - Microsoft Access (.mdb, evaluation only, 32-bit OS).  See [Database architecture](/fileaudit/docs/reference/database/architecture) Reference |
| **Disk space** | 150 MB for the FileAudit installation, plus additional space for the database. |
| **Windows Security log size** | 250 MB recommended, enough to retain at least 30 minutes of audit data without overwriting |
| **Accounts used** | - LocalSystem account (must remain enabled on audited servers); - FileAudit server computer account (read access to Active Directory Users and Computers); - Local administrator privileges required on audited servers for remote auditing.  See [Accounts](/fileaudit/docs/reference/settings#accounts) Reference |
| **Memory** | 2 GB RAM minimum, 4 GB or more recommended |
| **CPU** | Dual-core 2 GHz minimum |
| **Display resolution** | At least 1024 x 768 |

## Network and service requirements

FileAudit needs the following ports, protocols, and services allowed between the FileAudit server and the audited servers.

| Requirement | Details |
| --- | --- |
| **Protocols** | ICMP (Ping) and SMB (TCP 445) must be allowed from the FileAudit server to all audited servers |
| **Remote Event Log Management** | Must be enabled and authorized in the Firewall Exceptions on audited servers to allow FileAudit to collect Windows Security events remotely |
| **Remote Registry service** | Must be running on audited servers to allow FileAudit to retrieve and manage required configuration information |
| **Remote FileAudit console connection** | TCP port 2000 by default. See [Connect remotely to a FileAudit service](/fileaudit/docs/guides/installation/connect-remotely-to-a-fileaudit-service) Guide |
| **Cloud auditing** | TLS 1.2 required for connections to cloud providers. See [Cloud audit](/fileaudit/docs/reference/core-concepts/cloud-audit) Reference |

## Known limitations and deployment considerations

- FileAudit collects file access activity exclusively from Windows Security events. If system resources, auditing policies, log size, network access, or database configuration aren't properly maintained, events may not be collected reliably.
- Workstation operating systems can be audited, but installing the FileAudit service on a workstation isn't recommended.
- Only active/passive failover clusters are supported. When the active node changes, the correspondence between drive names and logical names must be manually reconfigured.
- For 15 or more audited servers, [contact our support](/fileaudit/docs/support/need-assistance) to confirm whether additional requirements apply.

## Next step

Once your server meets these requirements, continue with [Installing FileAudit](/fileaudit/docs/getting-started/installation) Getting started to install the service and open the console.