Windows file / folder Auditing not working if member of AD domain

Question

I need to implement file / folder auditing for Windows 7-10 workstations so that all access by members of Domain Admins (read, write/modify, create, delete) is logged.

I have enabled "Audit object access" in the group policy and it is in effect (rsop.msc):

I then set the auditing properties for a test folder:

Right-click folder > Properties > Security > Advanced > Auditing tab > click Continue > Add > Domain Admins > Check all for Successful and Failed:

I see a few entries in the Security event log for the setting of the audit properties above (e.g. "Auditing settings on object were changed."), but when I modify or delete a file in that folder, no events are generated in the security log. I also tried to use "Everyone" instead of "Domain Admins" in the auditing settings, but that did not make a difference.

The above test is on Windows 7 Pro x64 SP1 w/ all updates.

What am I missing? How can I get the auditing to work as desired?

-- Update 1 ---

I just tested with a Windows 7 and a Windows 10 machine that are not a member of the AD domain and it worked like a charm!

It is almost as if the "Audit object access" is not in effect (even though it shows as "Success, Failure" in both rsop.msc and "gpresult /z").

Is there something else that I need to do in the GPO or what could be causing this not to take effect?

Answer 1

I finally found what was going on in this article:

https://blogs.technet.microsoft.com/askds/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2/

as soon as you start applying Advanced Audit Configuration Policy, legacy policies will be completely ignored.

I am using advanced audit configuration in the GPO, which rendered the legacy "Audit object access" ignored.

I switched to using the advanced audit configuration for the object access auditing instead and it works fine now.

Answer 2

You first will need to turn on auditing, from either local policies, or domain policies and apply it to the machine you want to audit. Once the policy is set you need to configure auditing on everything you want to audit, and that will start adding events to the event log.

Once that is in place, go to the folder you want to monitor, right click and go to properties

Click the security tab --> Advanced --> Auditing Tab --> Edit --> Add --> then add the group that has access to that folder --> Select the events you want to audit and click OK --> Select Replace all existing inheritable audit entries, to appply the audit on all sub folders and files and click OK

In Windows 7 and Windows Server 2008 R2, the number of audit settings for which success and failure can be tracked has increased to 53. This step-by-step guide demonstrates the process of setting up an advanced Windows 7 and Windows Server 2008 R2 security auditing policy infrastructure in a test environment. It also guides you through the process of configuring some representative advanced security audit policy settings: https://technet.microsoft.com/en-us/library/dd408940(v=ws.10).aspx

Moreover, to get automatic email alerts on predetermined access events such as a file deletion, access denied, read/write, specific user or file access etc. then you will get help from this auditing solution.

Thanks,