Skip to content

File Audit

The File Audit configuration within a group defines rules for monitoring file system activity on the Windows machines assigned to that group. File audit rules instruct EventLogAgent clients to monitor specific directories for file operations such as reads, writes, deletions, renames, and permission changes, and forward matching activity to LT Auditor MP or the configured syslog destination.

Understanding file auditing in EventLogCentral:

File auditing in EventLogCentral works through Windows Security event logs rather than a separate agent mechanism. Specifically it uses Windows Security Event IDs:

Event ID Description
4656 A handle to an object was requested
4670 Permissions on an object were changed

Because file audit relies on Windows Security event logging, Windows Object Access auditing must be enabled on monitored machines before file audit rules will generate events. Without this, EventLogAgent has nothing to collect regardless of how file audit rules are configured.

Rules are evaluated locally on each client — only matching events are forwarded to reduce network traffic and SIEM ingestion volume.

Enabling Windows Object Access auditing:

Before configuring file audit rules, confirm that Windows Object Access auditing is enabled on the target machines. This can be done via Group Policy:

  1. Open Group Policy Management Console
  2. Edit the GPO applied to the relevant machines
  3. Navigate to:

Computer Configuration → Policies → Windows Settings →

Security Settings → Advanced Audit Policy Configuration →

Object Access

  1. Enable Audit File System for Success and Failure
  2. Apply the GPO

[Your administrator should confirm that Object Access auditing is enabled across all machines in groups where file audit rules are configured before expecting file audit events to appear in LT Auditor MP.]

Accessing file audit configuration for a group:

  1. In the left navigation menu, click Groups
  2. Locate the group you want to configure
  3. Click the ⋮ menu next to the group
  4. Select File Audit

Creating a file audit rule:

  1. Click Add Rule
  2. Configure the rule details:

Rule Name: A descriptive name for the rule:

Example: Monitor HR Documents

Example: Critical Config Files

Example: Finance Share Activity

Path: The full directory path to monitor on the client machine:

Windows examples:

C:HRDocuments

C:WindowsSystem32config

\fileserver01sharesFinance

Recursive: Whether to monitor subdirectories within the specified path:

Setting Description
Enabled Monitor the specified path and all subdirectories
Disabled Monitor only the specified path — subdirectories are not included

Operations: Select which file operations to monitor:

Operation Description
Read File read access
Write File write or modification
Delete File deletion
Rename File or folder rename
Permission Change Changes to file or folder permissions

Include Patterns: File name patterns to include in monitoring. Leave blank to monitor all file types:

Examples:

*.docx, *.xlsx, *.pdf

SAM, SYSTEM, SECURITY

*.csv, *.txt

Exclude Patterns: File name patterns to exclude from monitoring — useful for filtering out temporary or system-generated files that create noise:

Examples:

~$*        (temporary Office files)

*.tmp      (temporary files)

*.log      (log files)

  1. Click Save

Example file audit rules:

Example 1 — Monitor HR documents:

Rule Name: HR Documents

Path: C:HRDocuments

Recursive: Yes

Operations: Read, Write, Delete, Rename, Permission Change

Include Patterns: *.docx, *.xlsx, *.pdf

Exclude Patterns: ~$*, *.tmp

Example 2 — Monitor critical Windows configuration files:

Rule Name: Critical Config Files

Path: C:WindowsSystem32config

Recursive: No

Operations: Write, Delete, Rename, Permission Change

Include Patterns: SAM, SYSTEM, SECURITY

Exclude Patterns: *.log, *.tmp

Example 3 — Monitor a sensitive network share:

Rule Name: Finance Share

Path: \fileserver01sharesFinance

Recursive: Yes

Operations: Read, Write, Delete, Permission Change

Include Patterns: (blank — monitor all file types)

Exclude Patterns: ~$*, *.tmp, Thumbs.db

Editing an existing file audit rule:

  1. Navigate to the group’s File Audit configuration
  2. Locate the rule to edit
  3. Click the Edit icon
  4. Modify the settings as needed
  5. Click Save

Deleting a file audit rule:

  1. Locate the rule in the File Audit list
  2. Click the Delete icon
  3. Confirm the deletion

Troubleshooting file audit:

If file audit events are not appearing in LT Auditor MP, work through the following checks:

Problem Likely Cause Resolution
No file events appearing Windows Object Access auditing not enabled Enable Audit File System via Group Policy
No file events from a specific path Path does not exist on the client Confirm the path exists and is accessible on the target machine
No file events for specific file types Include pattern too restrictive Review and update the Include Patterns setting
Excessive noise from a path Exclude pattern too broad or missing Add or refine Exclude Patterns to filter out unwanted files
File events appearing but not forwarded Audit policy suppressing events Review group Audit Policies for DENY rules affecting file event IDs
Network share not being monitored Agent lacks access to the share Confirm the EventLogAgent service account has read access to the network path

Best practices:

  • Always confirm Windows Object Access auditing is enabled before configuring file audit rules — without it no events will be generated regardless of rule configuration
  • Be specific with monitored paths — targeting entire drives generates extremely high event volumes and significant performance impact on client machines
  • Use Include Patterns to limit monitoring to file types most likely to contain sensitive data
  • Use Exclude Patterns to filter out temporary files, log files, and other noise sources from the start
  • Disable the Read operation for high-traffic directories if write, delete, and permission change monitoring is sufficient — read events can generate very high volumes on busy file servers
  • Test file audit rules on non-production machines before deploying to production to assess event volume and performance impact
  • Confirm the EventLogAgent service account has appropriate read access to any network shares included in file audit rules

[Your administrator should document all active file audit rules and the business rationale for each monitored path so the configuration is auditable and can be reviewed during compliance assessments.]