Tool or command to find all objects being audited?

hdk001 used Ask the Experts™
I have a need to identify all objects with auditing enabled on several servers. Primarily, the request was to identify any failed object access auditing that has been enabled at the folder level by previous admins.

Short of going folder to folder, I'm not sure how to do this. It seems there must be some tool that could scour all the folders and output a list of folders w/any auditing enabled. I have searched for several days online and have been unable to come up with anything.
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2018
Distinguished Expert 2018
Try this from SystemTools/Somarsoft (my favorite tool): DumpSec (
Install the download on a client, uncheck "Hyena"; you can then copy DumpSec.exe and the help file to where you want.
For the fastest report, go to "Report > Permission Reports Options", check only "Show Audit Settings", and set the radio button to "Show directories (but not files) whose permissions differ ...".
If you suspect that auditing has been enabled on file level, you'll have to resort to the first option, "Show only directories and files whose permissions differ ...".
Then go to "Report > Dump Permissions for File System" and select the drive/folder you want to check.


This software worked great. I was discouraged at first due to the difficulty and time it takes to get software approved to bring in to our network (closed network and lengthy testing and approval process) I got lucky and this tool is actually included in the WASSP security compliance tool, which has already been approved, alleviating the need to wait out the approval.

Thanks for the quick and spot on answer.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial