---
locale: "en"
updated_at: "2026-08-04T12:07:49.911Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/guides/configuration/advanced/reduce-audit-noise-from-windows-search"
---

# Reduce audit noise from Windows search

Configure Windows indexing so content searches stop flooding FileAudit with read events.

## When Windows search creates audit noise

Windows searches run on indexed folders do not generate any events in FileAudit (except when the index is rebuilt), because the search uses the index rather than the files themselves.

Searches run on **non-indexed folders with content search enabled** are different. To retrieve the information, Windows has to open each file to read its contents, and FileAudit records every one of those reads. A single search can then produce a large number of false positives in your audit trail.

![Search System files](https://a.storyblok.com/f/122374/785x473/ad37d0d81f/system-files.png)

To avoid this, we recommend indexing the folders that users search. Verify that index contents is checked:

![Advanced properties](https://a.storyblok.com/f/122374/542x566/17a68ee237/advanced-attributes.png)

If the searched folders are on a file server, the Windows Search Service must be installed before you can index the shares. It is not installed by default. 

On a local machine, skip this section and go straight to indexing.

> **Note**
>
> See [Access types](/fileaudit/docs/reference/core-concepts/access-types) Reference for how FileAudit records a read.

## Install the Windows Search Service on a file server

On a file server, the Windows Search Service is not installed by default. Install it before indexing the shares. On a local machine, skip this section and go straight to indexing. 

1. In **Server Manager**, click **Manage**** > ****Add Roles and Features**.
  ![](https://a.storyblok.com/f/122374/418x220/6b240ea3f5/server-manager-add-features.png)
2. Select the **Windows Search Service** feature and complete the wizard.
  ![](https://a.storyblok.com/f/122374/786x560/ea65282a36/server-manager-add-windows-search.png)
3. After installation, make sure the Windows Search **service is started**. On some Windows Server versions it is set to Disabled by default.

## Add the searched folders to the Windows index

1. Open **Control Panel**** > ****Indexing Options**.
  ![Control panel Indexing options](https://a.storyblok.com/f/122374/748x571/e8d0cf77b1/control-panel-indexing-options.png)
2. Click **Modify**.
  ![Indexing options Modify](https://a.storyblok.com/f/122374/489x539/b9e3be40e4/indexing-options-modify.png)
3. Select the drives and folders users search, then confirm. You can add a single folder or an entire drive; Windows indexes them automatically.
  ![Indexed locations](https://a.storyblok.com/f/122374/398x573/2b44ee3b63/indexed-locations.png)

Once indexing completes, searches on these locations no longer generate read events.

> **Note**
>
> **⚠️ Important**
> Windows Search cannot be used with DFS. On a DFS namespace, searches are sent to the root DFS server instead of the indexed target, so indexing does not stop the read events.