Powershell script for Auditing

alanlam123
alanlam123 used Ask the Experts™
on
Hi

I suspect someone have transfer the file from his local machine.

We don’t have Audit trail turn on.

Question what is the powershell script to trace this?

Thank
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
View Solution Only
David Johnson, CD
Top Expert 2016

Commented:
You can't audit events in the past before auditing was enabled. If you close the barn door after the horse has gone, the horse is still gone.
AlanConsultant

Commented:
And therefore, turn on auditing now.

At least you will be able to check if it happens again.

Alan.
alanlam123

Author

Commented:
What is the step to turn on the audit policy in AD
Consultant
Commented:
Turn on auditing for a file or folder using the security settings.

See this MS article for the full steps:

https://technet.microsoft.com/en-us/library/cc771070(v=ws.11).aspx

Or by Group Policy:

https://technet.microsoft.com/en-us/library/dd277403.aspx

Alan.
alanlam123

Author

Commented:
Tks for the help

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial