Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns on audit for every files/folders. I have just enabled auditing on some folders....

any ideas?

share|improve this question
There is no Support for auditing only "some" Folders. You can handle this with a powershell script to get only the results of the Folder you want. get-help get-eventlog (Powershell cmdlet) – patricks Mar 19 '13 at 15:15
so it's either audit is enabled for everything or nothing? Then what's the use of putting audit on folders? – Alex Mar 19 '13 at 15:16
up vote 0 down vote accepted

I jsut found out how to do that. In a prompt you need to run this command : auditpol /set /subcategory:"File System" /Success:enable

Then you can specify audit on the folders/files you want.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.