I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns on audit for every files/folders. I have just enabled auditing on some folders....

any ideas?

  • There is no Support for auditing only "some" Folders. You can handle this with a powershell script to get only the results of the Folder you want. get-help get-eventlog (Powershell cmdlet) – patricks Mar 19 '13 at 15:15
  • so it's either audit is enabled for everything or nothing? Then what's the use of putting audit on folders? – Alex Mar 19 '13 at 15:16

I jsut found out how to do that. In a prompt you need to run this command : auditpol /set /subcategory:"File System" /Success:enable

Then you can specify audit on the folders/files you want.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.