You configure auditing policies by using Group Policy or local security policy. Group Policy is used when you want to set auditing policies for an entire site, domain, or organizational unit and is used as discussed in Part 7 of this book, "Managing Active Directory and Security." Local security policy settings apply to an individual workstation or server and can be overridden by Group Policy.

To enable auditing of files and folders for a specific computer, start the Local Security Policy tool by clicking Start, Programs or All Programs, Administrative Tools, and Local Security Policy. On a domain controller, select the Default Domain Controller Security Policy tool. Expand Local Policies, and then Audit Policy, as shown in Figure 21-26.

Figure 21-26. Access the local auditing policy settings.

Next, double-click Audit Object Access. This displays the Audit Object Access Properties dialog box shown in Figure 21-27. Under Audit These Attempts, select Success to log successful access attempts, Failure to log failed access attempts, or both options, and then click OK. This enables auditing but it doesn't specify which files and folders should be audited.

Figure 21-27. Configure auditing for object access.

Once you have configured enable Audit Object Access, you can set the level of auditing for individual folders and files. This allows you to control whether and how folder and file usage is tracked. Keep in mind auditing is available only on NTFS volumes. In addition, everything discussed about inheritance applies to files and folders as well—and this is a good thing. This allows you, for example, to audit access to every file or folder on a volume simply by specifying that you want to audit the root folder of the volume.

You specify files and folders to audit using Windows Explorer. In Windows Explorer, rightclick the file or folder to be audited, and then, from the shortcut menu, select Properties. In the Properties dialog box, select the Security tab, and then click Advanced. In the Access Control Settings dialog box, select the Auditing tab, as shown in Figure 21-28.

Figure 21-28. Specify to which users and groups auditing should apply.

You have the same two inheritance options discussed earlier in the chapter:

Now use the Auditing Entries list box to select the users, groups, or computers whose actions you want to audit. To add specific accounts, click Add, and then use the Select User, Computer, Or Group dialog box to select an account name to add. If you want to audit actions for all users, use the special group Everyone. Otherwise, select the specific user groups or users, or both, that you want to audit. When you click OK, you'll see the Auditing Entry For dialog box, as shown in Figure 21-29.

Figure 21-29. Determine the actions to audit for the designated user, group, or computer.

The Apply Onto drop-down list box allows you to specify which actions should be audited. Select the Successful or Failed options, or both, for the events you want to audit. The events you can audit are the same as the special permissions listed in Table 21-3 and Table 21-4, except you can't audit synchronizing of offline files and folders. Choose OK when you're finished. Repeat this process to audit other users, groups, or computers.

Any time files and folders that you've configured for auditing are accessed, the action is written to the system's Security log, where it's stored for your review. The Security log is accessible from Event Viewer. Successful actions can cause successful events, such as successful file reads, to be recorded. Failed actions can cause failed events, such as failed file deletions, to be recorded.