Windows Shared file access log

1. Introduction to the Environment
Server server2012:AD01.test.cn (Domain Admins: administrator)
Client win7:testpc1.test.cn (Domain account: sz1)
Client win7:test2-pc.test.cn (Domain account: SH1)
Server Create shared directory sharetest, grant domain Users full access rights

2. Steps
A.SERVER2012 click on "Server Manager"---"Tools"---"Group Policy Management"

B. In Group Policy Management, select Default Domain policy---Computer Configuration---windwos Settings---security settings---Local policy---audit policy, and on the right double-click Audit object access to "Define these policy settings" and "Success" two options

C. Right-click the shared folder (sharetest) Select "Properties" and select "Security"---"Advanced" in the pop-up window.

D. Select "Audit" in the pop-up window and click "Add"

E. After clicking "Main" in the new window, enter everyone under "Enter the object to select" In the new window, then click OK

F. Click "Show advanced Options" to tick the options for creating, modifying, deleting files or folders

3. Run Gpupdate/force on the server side, update Group Policy

4. Verification
A. Client access servers share folders and create new and delete operations
B. Server Click Server Manager---Tools---Component Services

C. Click "Event Viewer"---"Windows log"---"Security" on the right, click "Filter Current Log"

D. In the pop-up filter Log window, locate the "Include/Exclude Event ID ..." entry: 4663, OK

E. Viewing events

Windows Shared file access log