---
locale: "en"
updated_at: "2026-08-10T09:29:40.955Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/reference/settings"
---

# Settings

System, audit, database, email, and licensing parameters

## What the Settings section controls

The Settings section holds the global parameters that apply across all monitored paths and components. They control how FileAudit collects audited events, where it stores them, how it sends notifications, who can access the console, and how the license is managed.

Each subsection below corresponds to a tab in the Settings configuration window.

## Scan options

FileAudit collects access events from the Windows Security log of each monitored machine. Scan options decide which of those events are kept and how a few specific cases are handled before storage. Tuning these options directly **affects event volume**, database growth, and reporting relevance.

![Settings configuration - Scan options](https://a.storyblok.com/f/122374/1114x647/af13335f81/settings-scan-options-exclude.png)

### Exclusions

Exclusions drop matching access events before they reach the database. Excluded events are never recorded. Three exclusion types are available:

- **Accounts**: ignore all access events generated by the specified user accounts, for every access type.
- **Executables**: ignore events generated by the specified processes. Useful for backup agents, antivirus, indexing services, or scripts that would otherwise flood the audit.
- **File patterns**: ignore events based on the file name. Wildcards are supported for this type only: `*` matches any string, `?` matches a single character.

Wildcards apply to file patterns only. Account and executable exclusions match exact entries, as they appear in the reports.

> **💡️ Tip**
>
> Excluding noisy service accounts and executables is the most effective way to keep the database lean and reports readable.

### Ignore read access on executables

When Windows Explorer lists executable files, it loads their icons, which generates read access events on those files. FileAudit ignores these read events by default so they do not clutter the audit.

This setting affects read access only. Execute access events are always recorded. Turn it off only if you specifically need to capture read attempts on executable files.

### Audit file attribute changes

When enabled, FileAudit audits changes to NTFS file attributes such as read-only and hidden. This option is disabled by default.

> **⚠️ Important**
>
> Enabling this option changes the NTFS audit configuration that FileAudit applies to paths. Paths already configured for auditing will not capture attribute changes until they are reconfigured. 
> 
> Recheck the audit configuration of existing paths so the required NTFS settings are applied. Paths added afterward include them automatically.

### Exclude events from non-audited paths

NTFS auditing can sometimes be left in place on folders that FileAudit does not monitor, either from a manual configuration or from another tool. These folders generate unwanted events.

When this option is enabled, FileAudit processes only events that occur within paths it actually monitors. Events from any other location are discarded.

## Database

The Database tab shows the database that stores collected events and lets you register additional archive databases.

![](https://a.storyblok.com/f/122374/1282x553/11f55eea2a/settings-database.png)

### Production database

The production database receives every access event FileAudit collects. FileAudit ships with an embedded SQLite database and uses it automatically unless another provider is configured. Supported engines include SQLite, Microsoft SQL Server and SQL Server Express, and MySQL.

Two read-only fields describe the active database:

- **Database provider**: the engine currently in use, for example `System.Data.SqlClient`.
- **Connection string**: the server, database name, and authentication parameters the FileAudit service uses to connect.

**Edit** opens the database wizard to point FileAudit at a different database.

Regardless of the provider, the database itself, including availability, backups, performance, and storage, remains the customer's responsibility.

To move the production data to another engine, see [Migrate to another database](/fileaudit/docs/guides/database/migrate-to-another-database) Guide. For the underlying schema, see [Database architecture](/fileaudit/docs/reference/database-architecture) Reference.

### Archive databases

An archive is a separate database that holds older events you have moved out of production to keep the production database small. Registering an archive here makes it available as a data source: when running a report, you can choose to query the production database or one of the registered archives.

The Archives list shows, for each archive: provider, name, record count, first event date, and last event date. As with production, archive databases are maintained by the customer.

To create and populate an archive, see [Archive database](/fileaudit/docs/guides/database/archive-database) Guide.

## Email settings

FileAudit sends automated reports and real-time alerts by email. Both require a configured SMTP server. The SMTP configuration covers the server address, the port (for example 25, 465, or 587), SSL encryption, the sender email address, and the authentication mode.

![](https://a.storyblok.com/f/122374/978x688/a8ce04c9aa/settings-e-mail.png)

FileAudit supports several authentication modes, depending on the mail server:

- **Anonymous**: no authentication.
- **Windows authentication**: uses the FileAudit service credentials.
- **Provide credentials**: a dedicated username and password.
- **OAuth2**: for Microsoft or Google providers, requiring a Client ID, a Client Secret, and an interactive sign-in. OAuth2 also requires the Microsoft Edge WebView2 component on the console machine.

Email must authenticate successfully for reports and alerts to be delivered.

A **Test email** option sends a message to a recipient you specify, which confirms SMTP connectivity, authentication, and delivery in one step.

For the full setup, including OAuth2 for Microsoft and Google, see [Configure email settings](/fileaudit/docs/guides/configuration/configure-email-settings) Guide.

## Accounts

FileAudit scans the Windows Security log of each audited machine in real time. The scan requires at least local **administrator privileges on the target machine**. 

By default the FileAudit service runs under the LocalSystem account, which is usually enough for the local machine but is sometimes insufficient when auditing a remote machine.

When the service credentials are **not enough**, you define impersonation accounts in this tab. FileAudit uses them instead of the service credentials to reach the target machine. If several audit paths target different machines, you can assign a specific account per machine.

An impersonation account must hold the local `Log on as a batch job` right on the audited machine. Domain administrator accounts (Administrators) have this right by default, so no change is normally needed when using one. If that policy has been altered, add the impersonation account to it manually.

![](https://a.storyblok.com/f/122374/1286x774/9e66887937/settings-account.png)

> **Note**
>
> To use a local administrator account in a workgroup, enter a single dot in the domain field.

## License

The License tab shows the current license and its usage. 

The Details section reports the license type, the expiration date, and the licensed capacity in servers and users. 

![](https://a.storyblok.com/f/122374/1298x826/22244ef9d7/settings-license.png)

Usage is shown against that capacity for Windows servers and users, and for cloud servers and users when the Cloud add-on is licensed. 

Registering a serial number is done from this tab. See [Manage your license](/fileaudit/docs/guides/configuration/manage-your-license) Guide.

## Permissions

FileAudit permissions grant or deny access to features of the console for specific users or groups. They control the console only and do not affect file system permissions.

| Permission | Controls |
| --- | --- |
| Audit | Display of the reports |
| Configure Audit | Creating, modifying, or deleting an audited path |
| Configure Alerts & scheduled reports | Creating, modifying, or deleting alerts and scheduled reports |
| Configure settings | Access to the Settings configuration |
| Configure permissions | Access to the Permissions section itself |

FileAudit resolves rights the same way Windows does:

- **Deny overrides Allow**: if a user belongs to several accounts and any one of them denies a feature, access is denied.
- **Neither set means denied**: when neither Allow nor Deny is defined, access is denied, unless the account belongs to a group where the right is explicitly allowed.

![](https://a.storyblok.com/f/122374/1286x774/419348cdf4/settings-permissions.png)

> **⚠️ Important**
>
> Do not delete the default administrators rule, or you may lock yourself out of the feature.

To grant access to a user or group, see [Set up FileAudit permissions](/fileaudit/docs/guides/configuration/set-up-fileaudit-permissions) Guide.

## Service

This tab controls remote access to the FileAudit service and service-level email notifications.

### Remote connections

Enabling remote connections lets any FileAudit console on the network connect to this service. It also allows delegating the audit to non-IT users: once granted access through Permissions, they manage the audit from their own console. This feature cannot be disabled from a remote console.

The console connects to the service on a configurable port, **2000** by default. Any port change requires a service restart before it takes effect; you can save and restart immediately, or save only and restart manually later.

To set up a remote console, see [Connect remotely to a FileAudit service](/fileaudit/docs/guides/installation/connect-remotely-to-a-fileaudit-service) Guide.

> **Note**
>
> ⚠️** Important** 
> Make sure the configured port is allowed through your firewall.

### Email notifications

The tab also enables email notifications for the different service-level events FileAudit encounters. 

For the events themselves, see [Warnings](/fileaudit/docs/reference/warnings) Reference.

## Logo configuration

This tab customizes the layout of generated reports. You can:

- add a corporate header logo,
- add an optional header slogan,
- replace the footer logo.

Each option is enabled individually; enabling one reveals its configuration field, where you browse for an image or type the slogan text.

These changes apply to reports printed or exported from the File Access Viewer and to scheduled reports sent by email as PDF. They affect report presentation only and do not change any application behavior.

## Advanced settings

Advanced settings expose internal parameters that fine-tune specific FileAudit behaviors, such as database communication, Active Directory queries, scanning, and performance. They are separate from the tabs above and are intended for **troubleshooting or specific** environments, not for routine configuration.

> **Note**
>
> ⚠️** Important**
> Do not change these parameters unless IS Decisions support instructs you to, or a documented use case requires it. In most environments they should stay at their default values. Some changes take effect only after the FileAudit service restarts.

Open the panel from the console with the **F7** key. Parameters are grouped into categories:

- Active Directory,
- Cloud,
- Database,
- Mail,
- Misc,
- OAuth2,
- Performance,
- Scan.

Selecting a parameter shows its purpose and expected values at the bottom of the window.

![Advanced settings](https://a.storyblok.com/f/122374/1291x787/0b81783474/advanced-settings.png)