Access types
Windows access types
Here is the list of access types Audited by FileAudit for Windows file servers.
Windows access types | |
Delete | A user tried to delete a file/folder. |
Ownership | A user tried to take ownership on the file/folder |
Permissions | A user tried to change the permissions on the file/folder. |
Write | A user tried to modify a file. |
Execute | A user tried to execute an executable file. |
Read | A user tried to open a file in ‘Read’ mode. |
System | An attempt to read or write the System Access Control List (SACL), i.e. the audit entries of the file/folder. (Pre-Vista only). |
Write attributes | A user tried to modify a file attribute (like Read-only or Hidden checkboxes). |
Rename | A user tried to rename a file (available if using Vista/Windows Server 2008 onwards). |
Move | A user attempted to move a file / folder (available if using Vista/Windows Server 2008 onwards). |
Other | Composite events, where an event can be a combination of several access events - e.g. Write and read or Delete and read, etc. (Windows 2003 Server only) |
Take note that an event is generated for an attempted access. If a user without enough privileges attempts to delete a file on a monitored folder, you will be alerted of a ‘Delete’ event with a status ‘Denied’.
Cloud access types
Here is the list of access types audited for Cloud file storages.
Box | Dropbox | Google Drive | OneDrive | |
Read | check_circle 1 | check_circle 1 | check_circle 1 | check_circle 2 |
Write | check_circle | check_circle | check_circle | check_circle |
Delete | check_circle | check_circle | check_circle | check_circle |
Move | check_circle | check_circle 1 | check_circle | check_circle |
Copy | check_circle 1 | check_circle 1 | check_circle 1 | check_circle 1 |
Create | check_circle | check_circle | check_circle | check_circle |
Rename | check_circle | check_circle | check_circle | |
Download | check_circle | check_circle | check_circle | |
Shared | check_circle 3 | check_circle | check_circle | |
Unshared | check_circle 1 | check_circle | ||
Destroy (from trash) | check_circle 1 | check_circle 1 | check_circle 1 | |
Restore (from trash) | check_circle 1 | check_circle | check_circle 1 | |
Revert | check_circle | |||
Lock | check_circle | |||
Unlock | check_circle | |||
Check In 4 | check_circle | |||
Check Out 5 | check_circle | |||
Undo Check Out 6 | check_circle |
- 1: From web site only
- 2: From web site or Office 2016 app
- 3: No real-time notification but notified with next event
- 4: A user checked in a file in Sharepoint Online.
- 5: A user tried to checked out a file in Sharepoint Online.
- 6: A user discarded a check out of a file in Sharepoint Online.