Keeping track of changes made to your folders is an important part of maintaining a secure data environment within your Windows PC. Fortunately, Windows has a built-in feature that enables users to monitor views and changes to a specific folder. If you have a folder containing your sensitive data, you may need to know who is accessing or performing other actions in the folder. In this guide, we will teach you how to monitor user activities and track folder changes in Windows 10.
Tracking Changes to Folders with Windows Group Policy
Group Policy is a Windows security feature, mostly used by IT admins to manage computers within a network, but can also be used on your local computer. However, in Windows 10, the feature is only available in the Pro and Enterprise editions.
Accessing the Group Policy Editor
- In Windows 10, press the “Win + R” keys to open Run, type “GPedit.msc” and click “Ok”.
- Or search for “Edit Group Policy” in the Windows search box and choose the corresponding result.
- There are two main types of group policies: Computer and User policies.
- In this case, we will select the “Computer configuration” policies to audit changes from all the computer users.
Configure Audit Policy
- Expand the computer configuration policies, then navigate to “Windows Settings”, choose “Security Settings”, “Local Policies” and then expand the “Audit Policy” folder.
- You will find a number of policies on the right-side panel with their configuration status.
- Double click the “Audit object access” template to configure the properties.
- If you want to monitor both successful and failed changes to a folder, click to check the “Success” and “Failure” box.
- Click the “Apply” and then “Ok” to save the changes and close the GP editor.
Configure Folder Audit Settings
- Navigate to the specific folder you want to monitor in File Explorer.
- Right-click the folder and open its “Properties”.
- Move to the Security tab and click the “Advanced” button just below the users’ permissions.
- On the resulting window, switch to the “Auditing tab” and click the “Add” button to add user group.
- Select the PC-name Users as shown in the image and click “Ok”.
- This will lead you to the “Audit Entry for [folder name]” to choose what exactly you would like to monitor.
- You can choose to track the success or fail under “Type”, select the folder, subfolder and files to monitor changes to all the folder content.
- Click to check the box against the actions that you would like to track such as write, read, and execute and so on.
- Once you have picked your options, click “Ok”.
- Click “Ok” on the other folder properties wizard to close.
Related: Track real sender of email in Gmail.
Track Events with Event Viewer
- To monitor changes to a folder, you need to open the Event Viewer. In Windows search box, type “Event Viewer” and open the tool from the result.
- Go to “Windows Logs” and then “Security”. This will open a list of the recent activities on the middle panel.
- If you make changes to the folder you are monitoring; access, create/ delete a file or any other action, you will find a number of entries under the “System File” category.
- To see more details about the event, double click on the event and switch to the “Details” tab.
- To check through thousands of system file events, you may apply filter and only look through the most important events.
- To do so, click the “Click Current Log…” select the event level, enter the event Id and then “Ok” to filter. You can also use also sort by Event Id.
Track Folder Changes with 3rd Party
Alternatively, you can use other third party software to monitor changes to a folder. Some of these include:
- Folder Monitor – A free third-party software that helps to keep track of folder activities in Windows. It monitors several events including delete and create activities as well as notifying users about such changes. The tool has a simple UI and is easy to use; you just need to right-click the icon to add the folders that you want to monitor.
- FolderChangesView – another lightweight tool for monitoring folder activities in Windows. You only need to enter the folder/ sub-folder path and the program will keep track of creation, deletion or modification to the folder.
- TheFolderSpy – A Windows program that monitors changes to a specified folder type and notifies users of sub-folder modification.
- Watch for Folder – a program that allows users to select a folder or sub-folder and it sends notification about any changes like renaming, deleting and view among others. It can also send notification about connected or disconnected external devices.
If you have a sensitive folder or file in your PC, you need to keep an eye to see what changes are made to the folder, who made them and at what time. Fortunately, you can follow the above steps to monitor folder changes without installing any program or use a third-party program to keep track of folder activities.