0

I have left a sensitive file on my windows 10 desktop folder. The windows 10 instance is connected to a domain. I understand that the domain admin has full access to my desktop.

Is their a way for a low privileged use (me) to see when the domain admin last opened my desktop folder? Or any other information that could help me to check if the file on my desktop has been accessed without asking the domain admin?

Thankyou

1 Answer 1

2

To my knowledge it is only possible to view auditing information on a file/folder when auditing has already been set up. You can enable object access auditing by managing the access control on that object, much the same as you can manage permissions.

Depending on what you mean by 'low privilege', you may not be able to set up auditing, because you need to be an administrator of the local machine to do it.

To apply or modify auditing policy settings for a local file or folder:

  1. Right-click the file or folder that you want to audit, click Properties, and then click the Security tab.

  2. Click Advanced.

  3. In the Advanced Security Settings dialog box, click the Auditing tab, and then click Continue.

  4. To set up auditing for a new user or group, click Add. Click Select a principal, type the name of the user or group that you want, and then click OK.

  5. In the Type box, indicate what actions you want to audit by selecting the appropriate check boxes:

    • To audit successful events, click Success.
    • To audit failure events, click Fail.
    • To audit all events, click All.

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder

The group to use for the auditing would be Everyone or <PCNAME>\Administrators, depending on who you want to audit.

Once you have enabled auditing, you can view the audit logs by opening the Event Viewer and perusing the Security event logs.

Not the answer you're looking for? Browse other questions tagged .