I’m going to give the alert a name “Denied access Alice”. The first thing I can do is create a single access alert for any more ‘denied accesses’ on those sensitive folders that we saw – ‘Accounting and Peopleops’. I go back to the main menu and I’m going to access the alert tab. The next step that I want to put in place is some proactive alerts in case these kinds of accesses happen again. I’m just going to save Alice’s report as a PDF. Now that I’ve got this drilled down view of Alice’s accesses I’m going to go ahead and export it into a PDF in case I want to send it to a manager, or in case any other alerts come up with this same user. I can see that they happened simultaneously so that can lead me to believe that Alice is selecting a large number of files and copying them to an external drive or possibly to a desktop. I can scroll down further and see all these accesses from all these files and folders that were read at the same time on the same day. I can see there’s quite a lot of red flags here, once again some denied accesses on sensitive files such as ‘Accounting and Peopleops’. I can also see that Alice has tried to access these files on separate occasions from different machines.īecause of that, I’m now going to take a closer look at Alice’s overall activity by clicking on her username to bring up a dashboard of all the activity from this user, from the last few days and weeks. Here I can see quickly again that these accesses are denied and they’re by the same user Alice. I can now go ahead and take a closer look at this folder to see who has been accessing it. I can see easily from here that there are some denied accesses on ‘Accounting and Peopleops’ – some very sensitive folders that contain internal and client data.

So, I can see the date and time, the file or folder that was accessed or modified, the access type, whether or not it was denied or granted, the user who attempted to access/modify the file, the machine from where the access was made with its client IP address and the server where the file is stored. From there I can go directly into the ‘File Access Viewer’ to see in real time, the accesses that are happening on the shares that I’ve selected. Here in the console of the FileAudit software, the first thing you do is go to audit configuration and select the most sensitive files and folders on your network that you wish to monitor. In this video, I’m going to show you how FileAudit can help you to actively monitor accesses on your shared files and folders.

Windows utility to find files by date