Avatar of alanlam123
alanlam123
 asked on

Powershell script for Auditing

Hi

I suspect someone have transfer the file from his local machine.

We don’t have Audit trail turn on.

Question what is the powershell script to trace this?

Thank
PowershellNetworking

Avatar of undefined
Last Comment
alanlam123

8/22/2022 - Mon
David Johnson, CD

You can't audit events in the past before auditing was enabled. If you close the barn door after the horse has gone, the horse is still gone.
Alan

And therefore, turn on auditing now.

At least you will be able to check if it happens again.

Alan.
alanlam123

ASKER
What is the step to turn on the audit policy in AD
Your help has saved me hundreds of hours of internet surfing.
fblack61
ASKER CERTIFIED SOLUTION
Alan

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
alanlam123

ASKER
Tks for the help