FileAudit Documentation
FileAudit Documentation
You are here: Reference > Audit > Access types

Access types

Windows access types

Here is the list of access types Audited by FileAudit for Windows file servers.

Windows access types
Delete A user tried to delete a file/folder.
Ownership A user tried to take ownership on the file/folder
Permissions A user tried to change the permissions on the file/folder.
Write A user tried to modify a file.
Execute A user tried to execute an executable file.
Read A user tried to open a file in ‘Read’ mode.
System An attempt to read or write the System Access Control List (SACL), i.e. the audit entries of the file/folder. (Pre-Vista only).
Write attributes A user tried to modify a file attribute (like Read-only or Hidden checkboxes).
Rename A user tried to rename a file (available if using Vista/Windows Server 2008 onwards).
Move A user attempted to move a file / folder (available if using Vista/Windows Server 2008 onwards).
Other Composite events, where an event can be a combination of several access events - e.g. Write and read or Delete and read, etc. (Windows 2003 Server only)

Take note that an event is generated for an attempted access. If a user without enough privileges attempts to delete a file on a monitored folder, you will be alerted of a ‘Delete’ event with a status ‘Denied’.

Cloud access types

Here is the list of access types audited for Cloud file storages.

Box Dropbox Google Drive OneDrive
Read check_circle 1 check_circle 1 check_circle 1 check_circle 2
Write check_circle check_circle check_circle check_circle
Delete check_circle check_circle check_circle check_circle
Move check_circle check_circle 1 check_circle check_circle
Copy check_circle 1 check_circle 1 check_circle 1 check_circle 1
Create check_circle check_circle check_circle check_circle
Rename block check_circle check_circle check_circle
Download check_circle block check_circle check_circle
Shared block check_circle 3 check_circle check_circle
Unshared block check_circle 1 check_circle block
Destroy (from trash) block check_circle 1 check_circle 1 check_circle 1
Restore (from trash) block check_circle 1 check_circle check_circle 1
Revert block check_circle block block
Lock check_circle block block block
Unlock check_circle block block block
Check In 4 block block block check_circle
Check Out 5 block block block check_circle
Undo Check Out 6 block block block check_circle

  • 1: From web site only
  • 2: From web site or Office 2016 app
  • 3: No real-time notification but notified with next event
  • 4: A user checked in a file in Sharepoint Online.
  • 5: A user tried to checked out a file in Sharepoint Online.
  • 6: A user discarded a check out of a file in Sharepoint Online.