Windows Guides Feed

PadlockedImagine that you have a shared folder but you want to know if someone changes something. You, for sure, have heard about auditing files before and may never had a chance to take advantage of this feature. Here you will find a way to do it.

With Windows 7 we can control when a folder has changed and show a message to us.

I know this post can be a little complex, but believe me, the best way to control your computer is knowing how works.

So, why not start from the beginning?

Press WinKey + R, type gpedit.msc, and press Enter.

Go to Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, Local policies, Audit Policy.

Audit Policy Group Policy

Double click over Audit object access.

Select Success, this way the message will only pop when something has changed.

Audit Object Access Properties

Other way to do this is not granting permission to files and see how someone try to change it.

Right click over the folder you want and select properties.

Select the security tab.

General Security Details Previous Versions

Press Advanced, go to auditing tab and press continue.

Advanced Continue

You can choose the users you want to audit. If you prefer to do it for all select everyone.

A list of check boxes appears:

Auditing Settings

Select Create files / write data , Create folders / append data, Delete subfolders and files and Delete.

This way the operating system creates an event when something changes on the folder. Press Ok on every open window. If you finish now, those messages appears on the event viewer.

We are going to complicate the thing a little bit, creating a scheduled task that shows a message when this happens. Don’t do this if this folder is accesed by a lot of people.

Press WinKey + R type control and press Enter, System and Security.

Select Schedule tasks.

Administrative Tools Schedule Tasks

Press Create Task, on the right pane.

A window appears asking you to type a name for the task you are going to create.

Select Triggers Tab, and go to New. You can specify when the task begins, in this case we are going to choose by an event.  The rest  will show the same as this image:

Task Trigger On An Event

As you see the message appears if there is an auditing event. This doesn’t discriminate if is in other folder.

Go to Actions tab, press New
Select Action, Start a program:

Schedule Task Start A Program

In the Program/script type msg:

Program Script Msg

Now in the arguments type the following:

* /server:localhost Someone is writing in your folder

Now if you change something in that folder, the next message appears:

Someone Is Writing In Your Folder



About Angel Luis

I am an Engineer of Telecommunications that love computers. My first computer was a Commodore 16kb, about 25 years ago and since then I am always fighting computers problems. Please visit my entries and ask me about whatever problem you have, I will be pleased to help you. My email is discoveryourpc [at] gmail [dot] com. You can follow me on twitter @agenlu or read my blog www.discoveryourpc.net

Free PC tips by email

Search Windows Guides




Comments

6 thoughts on “Use Scheduled Tasks and Audit Features to Control a Folder [How To]”

  1. RSVR85 says:

    Great guide Angel. Though it seems very long-winded to achieve a simple task (damn MS!). Anyway, thank you :)

    P.S. “Go to Local Computer Policy, Windows Settings, Audit Policy.” Should read “Go to Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, Local policies, Audit Policy.

    Also, under the Auditing tab in the folders security settings, there appears to be no 'Continue' button. All there is, is an 'Edit' button where you can click 'Add' to add the user accounts as you specified.

    1. Angel Luis says:

      Thanks for the comment. I will update the Guide.

      I swear that this is what appears in my auditing tab:

      To continue, you must be an administrative user with priviligies to view this object’s auditing properties.
      Do you want to continue?

  2. Angel Luis says:

    Thanks for the comment. I will update the Guide.

    I swear that this is what appears in my auditing tab:

    To continue, you must be an administrative user with priviligies to view this object’s auditing properties.
    Do you want to continue?

  3. Angel Luis says:

    Thanks RSVR85 I will update the guide.

    I swear that in my audit tab that message appears.

  4. RSVR85 says:

    Ah…I have UAC off, it's probably something to do with that. :)

  5. Angel Luis says:

    In the virtual machine I use for these things the UAC is on so probably is that.

    Anyway, thanks for reading the article.

Comments are closed.


Computer tips in your inbox
Sign up for the Windows Guides newsletter to get PC tips and access to free Windows books (More details)

Enter your email address:
 

Popular Guides

See which sites have been visited on your PC (even if private browsing mode is used)

Create a Windows 7 System Repair Disc

Best Free Anti-malware

Hibernate vs. Sleep vs. Shut-Down

i3, i5, and i7; Dual, Quad, Hexa Core Processors. How to they Differ?

Intel's Ivy Bridge Processor: new Features

Submit Your Tip
Submit your computer tip to us; receive full credit for all published tips

Windows Guides on Facebook