How to View Shared Folder History on Windows Server 2022

To view the history of shared folder activity on Windows Server 2022, you must enable Advanced Audit Policy for Object Access and configure Security Auditing on the specific folders. This process generates Event ID 5140 (network share access) and Event ID 5144 (file share access), allowing administrators to track who accessed files and when.

Enabling Audit Policies

Windows Server does not log file system activities by default because of the performance overhead. To capture detailed history, you need to modify the Group Policy settings on your server. Open the Group Policy Management Console and edit the Default Domain Controllers Policy or a custom policy linked to your server. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access. Here, you must enable two specific policies: Audit File Share and Audit Other Object Access Events. Set both to "Success" and "Failure" depending on your security requirements. Enabling "Success" allows you to see legitimate access patterns, while "Failure" helps identify unauthorized attempts. After applying these changes, run gpupdate /force in an elevated command prompt to ensure the settings take effect immediately on the local machine.

Configuring Folder-Specific Auditing

Global audit policies are not enough; you must tell Windows which specific folders to monitor. Right-click the shared folder you wish to track and select Properties. Go to the Security tab and click the Advanced button. In the Advanced Security Settings window, switch to the Auditing tab. Click Add to create a new auditing entry. You can choose to audit specific users, groups, or "Everyone" if you want comprehensive coverage. Under Type, select All to capture every access attempt. Crucially, check the boxes for Basic permissions such as Read, Write, and Modify. This step ensures that any interaction with the files within that folder triggers a log entry. Click OK to save these settings. Note that this configuration applies recursively to all subfolders and files unless you specify otherwise.

Locating the Logs

Once auditing is active, data begins accumulating in the Windows Event Viewer. Open eventvwr.msc and navigate to Applications and Services Logs > Microsoft > Windows > Security. Look for events with IDs 5140 and 5144. Event 5140 indicates a network share was accessed, providing details like the remote address and share name. Event 5144 provides more granular detail about the specific file path and the account that accessed it. You can filter these logs by right-clicking the Security log and selecting Filter Current Log. Enter the event IDs to isolate the relevant entries. For large environments, consider using PowerShell to export these logs to a CSV file for easier analysis. The command Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140,5144} retrieves recent entries quickly.

Managing Performance Impact

Auditing every file operation can significantly degrade server performance, especially on high-traffic shares. It is best practice to audit only critical directories rather than entire drives. If you notice increased CPU usage or I/O latency, review your auditing scope. Consider using WMI filtering or third-party monitoring tools that aggregate logs without impacting the primary OS kernel. For related troubleshooting steps, refer to our guide on Troubleshooting Windows Server issues.

Best Practices for Implementation

Always test auditing rules in a non-production environment first. Verify that the expected events are generated before deploying them widely. Regularly archive old logs to prevent the Security log from filling up, which could cause applications to fail. Use Event Subscription features to forward logs to a central SIEM or log server for long-term retention and correlation.

Frequently Asked Questions

What is the difference between Event 5140 and 5144?

Event 5140 reports that a network share has been accessed, focusing on the connection itself. Event 5144 provides detailed information about the specific file or directory accessed within that share. Use 5144 when you need to know exactly which document was viewed or modified.

Can I audit unshared folders?

Yes, you can audit local folder access by enabling the "Audit File System" policy instead of "Audit File Share." This captures access via local paths rather than SMB network connections. However, this requires different SACL configurations and may have higher performance costs.

Why are my audit logs missing?

Missing logs usually indicate that the global audit policy is not enabled or the folder SACL is incorrect. Verify that "Audit File Share" is set to Success in Group Policy. Also, ensure that the auditing entry in the folder's Security tab is applied correctly and not overridden by parent objects.

Does auditing affect server performance?

Significant auditing, especially on busy servers, can increase disk I/O and CPU usage. Microsoft recommends limiting auditing to critical resources only. Monitor server metrics after enabling auditing to determine if performance degradation occurs.

How do I export audit logs for reporting?

Use PowerShell commands like Get-WinEvent to query specific event IDs and export them to CSV or XML formats. You can schedule these scripts to run daily and send reports via email. This method is more efficient than manually browsing Event Viewer for compliance audits.