Windows Group Policy's

Group Policy Audit Object Access

Windows Group Policy Name :- Audit object access

Requirements :-

  • Work on any windows OS

Description :-

This security setting determines whether the OS audits user attempts to access non-Active Directory objects. Audit is only generated for objects that have system access control lists (SACL) specified, and only if the type of access requested (such as Write, Read, or Modify) and the account making the request match the settings in the SACL. The administrator can specify whether to audit only successes, only failures, both successes and failures, or to not audit these events at all (i.e. neither successes nor failures). If Success auditing is enabled, an audit entry is generated each time any account successfully accesses a non-Directory object that has a matching SACL specified. If Failure auditing is enabled, an audit entry is generated each time any user unsuccessfully attempts to access a non-Directory object that has a matching SACL specified. Note that you can set a SACL on a file system object using the Security tab in that object's Properties dialog box. Default: No auditing.

Note :-

Notepad

For more control over auditing policies, use the settings in the Advanced Audit Policy Configuration node.

Main Directory :-

Sub Directory :-

Policy Path :-

Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy

Policy Path :-

configure-group policy - audit object access

Policy Path :-

output-group policy - audit object access

Note :-

Notepad

After changing group policy options, you need to update group policy. If you do not update group policy then settings will not effect. To update it just simply type below command and also sample image is shown.

Command :-

gpupdate /force

output-update-group-policy
Notepad

In about command we used "/force" option, this will help up to update policy options forcefully.