My goal is to identify what user has set the Hidden attribute on a file within the local file share.
I have enabled File Share access auditing as per this article. In short: Added a group policy entry to enable certain accesses to be written to Event Log + enabled auditing on the Folder level for all access types.
As a result, I get such entries in Event Log:
Subject: Security ID: Domain\Username Account Name: Username Account Domain: Domain Logon ID: 0x329558 Object: Object Server: Security Object Type: File Object Name: E:\share\filename.xml Handle ID: 0xfc4 Resource Attributes: S:AI Process Information: Process ID: 0x4 Process Name: Access Request Information: Accesses: WriteAttributes Access Mask: 0x100
What attributes exactly did the user set? Is it what is listed in Resource Attributes? They don't look like they mean 'Hidden', and I don't get any other entries in the Event Log of type WriteAttributes (I search thoroughly via PowerShell). And some process is definitely setting this Hidden flag.
- Does this Event Log entry contain information about the attributes that the application was actually setting?
- How else can I track this activity? Process Monitor did not capture a single SetBasicinformationFile event, but the file has still become Hidden!