How to Track and Audit Registry Changes
Tracking registry changes is one of the important task in Windows Auditing. We can easily track and find who and …
File Access Auditing
Event ID 4663 – An attempt was made to access an object
Event ID 4663 is logged whenever an object accessed by user or other sources. It will be used mainly for …
How to Track File Access, Modify and Delete Actions in Windows Folder
Monitoring who accessed, modified, created, or deleted a File in Windows Folder is one of the frequent task for everyone. …
Event ID 4985 – The state of a transaction has changed
In this article, I am going to explain about the Event ID 4985, how to enable Event ID 4985 using …
Enable File Access Auditing in Windows
In this article I am going to explain about File System Access Auditing and how to enable File System Access …
Event ID 5145 – Detailed File Share Auditing
Description The Event ID 5145 is controlled by the security policy setting Detailed File Share Auditing which allows you to …