Manage Windows audit

FileAudit organizes Windows auditing around two objects: the servers it monitors and the paths (folders or files) audited on each server. This guide covers the recurring operations on both:

• adding paths

• checking paths

• removing paths

• enabling or disabling a server

• verifying the audit status on a server

• revoking a server

• maintenance of the audit configuration

You can add a path to audit at any time. A wizard handles the configuration and applies the required Windows audit settings automatically.

1. In the console, go to Windows paths or Windows servers.

2. Click Add a path, then browse to the file or folder to audit.

3. Complete the wizard. For the detail of each step (audit policy, SACL deployment, inheritance, real-time monitoring), see Configuring your first audit path Getting started.

If the path is on a server FileAudit does not yet monitor, adding the path registers that server in the audited servers list automatically.

Use this check when events stop appearing for a path, or after a folder's permissions or audit settings may have been changed by another tool or a GPO.

1. In Windows paths, select the path to verify.

2. Click Check audit.

3. If the NTFS audit is configured correctly, a confirmation message appears.

4. If a problem is detected, the wizard opens so you can reconfigure the SACL on that path. Complete the wizard to restore the configuration.

Removing a path stops monitoring it but keeps the events already collected.

1. In Windows paths, select one or more paths.

2. Click Delete and confirm.

Disabling a server pauses event collection without losing its configuration. This is useful during maintenance windows or when troubleshooting a noisy server.

1. In Windows servers, click the server tile to open its detail panel.

2. Toggle Active Audit off to pause collection, or on to resume it.

While auditing is disabled, no events are written to the database for that server and its alerts stop firing. Audited paths and alert rules are retained, so re-enabling the toggle restores collection without reconfiguration.

This check confirms that the Windows Audit Object Access policy is correctly applied on the server, which is the policy that allows Windows to generate file access events at all.

1. In Windows servers, open the server tile.

2. Click Check audit status.

If the check reports a problem, the policy may be overridden by a GPO. See the Warnings Reference page for diagnostic messages, and Windows audit Reference for how the policy interacts with Group Policy.

Revoking removes a server from FileAudit entirely. Use it when you stop monitoring a machine for good and want to free its licensed slot.

1. In Windows servers, open the server tile.

2. Click Revoke server and confirm.

From the Database & Audit Maintenance tile on the dashboard, you can schedule regular maintenance of the audit configuration on audited servers from the Audit tab.

When an audited path is added, FileAudit activates the object access audit policy on the server where the audited files are stored, as well as NTFS auditing on each path. These maintenance tasks check that these configurations have not been modified or overwritten by a GPO, and reconfigure them if necessary.

The Scheduling panel in Audit let you run automatic audit maintenance on a recurring basis.

1. Enable automatic maintenance switch.

2. Configure the duration. If the maintenance check does not complete running over all your audited paths within this time, it will pick up where it left off the next time it is scheduled.

3. Set Schedule task to the frequency you want.

4. Set the Start time.

5. Select the Days of week to run the task.