{"id":1222,"date":"2010-01-18T12:42:49","date_gmt":"2010-01-18T10:42:49","guid":{"rendered":"http:\/\/contoso.se\/blog\/?p=1222"},"modified":"2010-01-18T13:48:28","modified_gmt":"2010-01-18T11:48:28","slug":"auditing-files-in-windows-with-acs","status":"publish","type":"post","link":"http:\/\/contoso.se\/blog\/?p=1222","title":{"rendered":"Auditing files in Windows with ACS"},"content":{"rendered":"

I have been doing some tests for file auditing with Audit Collection Services (ACS). Unfortunately Windows file auditing doesn\u00c2\u00b4t really generate informative logs. It is most often the same event ID and the event description is very technical. I did some file operations and reviewed all events in the security event log. I think I have found a way to almost sort all the different file operations in different ACS reports. The first thing you need to do is enable auditing in both a policy<\/a> and on the folder<\/a>. I have used the built-in Microsoft Report Builder to create my new ACS reports. You can read more about creating ACS reports here<\/a>. I have built\u00c2\u00a0four reports. You could merge them into one and you can add\/remove any parameter you want. It could be nice with relative dates and an input field for user name and object name. One of the first thing I did was match ACS report parameters with parameters in security events, below is\u00c2\u00a0the result from that exercise<\/p>\n