Question Freeware file auditing?

[alexulmiste]

Hello, my question is about free file auditing software. Are there any free file server auditing softwares that atleast brings out if files are deleted, modified, renamed, moved, and WHO, WHEN, WHERE. I have tried out ADAudit plus, its amazing but it costs a good amount of money. Would love something similar to it but for free.

 

[Ralston18]

If you are working in IT (and even directly not) then I suggest taking a look at Powershell.

Very good chance that you will be able to create your own customized auditing script. For free.

And learning Powershell is likely to prove very useful for future applications and requirements.

Also there are some things you can do via Group Policy.

Reference:

https://www.varonis.com/blog/windows-file-system-auditing/

Here is a link that encompasses both Group Policy and Powershell:

https://gallery.technet.microsoft.com/scriptcenter/Easy-File-Server-Audit-94817a68

Overall for the most part I expect that you will be working mostly with "Gets" and not actually changing any file attributes.

Generally safe but do indeed always ensure that you have backups the are recoverable and readable.

Just start simple addressing the basic requirements and expand accordingly.

 

[alexulmiste]

If you are working in IT (and even directly not) then I suggest taking a look at Powershell.

Very good chance that you will be able to create your own customized auditing script. For free.

And learning Powershell is likely to prove very useful for future applications and requirements.

Also there are some things you can do via Group Policy.

Reference:

https://www.varonis.com/blog/windows-file-system-auditing/

Here is a link that encompasses both Group Policy and Powershell:

https://gallery.technet.microsoft.com/scriptcenter/Easy-File-Server-Audit-94817a68

Overall for the most part I expect that you will be working mostly with "Gets" and not actually changing any file attributes.

Generally safe but do indeed always ensure that you have backups the are recoverable and readable.

Just start simple addressing the basic requirements and expand accordingly.

Hey, thanks for your reply. Yes, i was thinking about creating my own customized auditing script, but don't know how to. Im working for IT indeed, but not scripting side.

 

[Ralston18]

You are welcome.

Get-ChildItem is a good starting point.

https://stackoverflow.com/questions/57855264/get-attributes-for-list-of-files

Again, do your learning on a test system in a test environment where if things go astray (or downright wrong ) then no harm/no foul.

 

[alexulmiste]

You are welcome.

Get-ChildItem is a good starting point.

https://stackoverflow.com/questions/57855264/get-attributes-for-list-of-files

Again, do your learning on a test system in a test environment where if things go astray (or downright wrong ) then no harm/no foul.

Wait, is the second link you sent me pre made custom script and free to use?

 

[Ralston18]

Second link in Post #2?

Should be open source and free.

However, the caveat being that running an entire script (e.g., FileServerAuditReport.ps1) without fully understanding what the script is doing may not end well.

Or if you try to modify the script in some manner.

Hence the need for a test environment.

-----

It can be very useful to take the output from such scripts and establish a database table to make the results searchable and sortable.

Very straightforward, in many cases, to send the data to Excel (via CSV) and use (if necessary) as the back end data for Access.

 

[alexulmiste]

Is there any way i can get get reports live, without having to set certain time to receive report log. Or refresh button, so when its pressed, then it will print out report log right away.

 

[USAFRet]

Is there any way i can get get reports live, without having to set certain time to receive report log. Or refresh button, so when its pressed, then it will print out report log right away.

You can modify that to spit out however you want.
Immediately, directly out to .csv (used in Excel). Or a hundred other different ways.

That falls under the concept of "Learning PowerShell"
https://docs.microsoft.com/en-us/po...rn/more-powershell-learning?view=powershell-7
https://github.com/PowerShell/PowerShell/tree/master/docs/learning-powershell

Just like you don't take random scripts you find and run them against your production environment.
You need to know exactly what they are and are not doing, and how it relates to your environment.

They are a good starting place. Nothing more.