Link to home
Create AccountLog in
Avatar of alanlam123
alanlam123

asked on

Powershell script for Auditing

Hi

I suspect someone have transfer the file from his local machine.

We don’t have Audit trail turn on.

Question what is the powershell script to trace this?

Thank
Avatar of David Johnson, CD
David Johnson, CD
Flag of Canada image

You can't audit events in the past before auditing was enabled. If you close the barn door after the horse has gone, the horse is still gone.
And therefore, turn on auditing now.

At least you will be able to check if it happens again.

Alan.
Avatar of alanlam123
alanlam123

ASKER

What is the step to turn on the audit policy in AD
ASKER CERTIFIED SOLUTION
Avatar of Alan
Alan
Flag of New Zealand image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Tks for the help