How to View History Log of Shared and Unshared Folders in Windows Server 2022

To view the history log of shared and unshared folders in Windows Server 2022, you must enable Advanced Audit Policy settings for File System auditing. This process records access events to specific directories, allowing administrators to track who accessed files and when. Without this configuration, Windows does not retain detailed access logs by default, making troubleshooting sharing issues difficult.

Enabling Advanced Audit Policy

The foundation of folder logging lies in the Group Policy Management Console. You need to configure the system to audit object access events. Open the Group Policy Management tool on your domain controller or local server. Navigate to the policy you wish to edit, typically Default Domain Policy for a domain environment or Local Security Policy for a standalone server. Expand Computer Configuration, then Policies, and select Windows Settings. Click on Security Settings, followed by Advanced Audit Policy Configuration, and finally Audit Policies. Locate the setting named Audit File System. Double-click it to open the properties window. Check both the Success and Failure boxes to ensure all access attempts are recorded. This step is critical because without enabling the global audit policy, no file system events will be generated regardless of subsequent folder-specific configurations. After applying these changes, you must update the group policy on the target server. Open a command prompt with administrative privileges and run the command gpupdate /force. This ensures that the new security policies are immediately active on the server. If you are managing multiple servers, consider using Group Policy Preferences or scripts to distribute these settings efficiently across your infrastructure. For broader context on maintaining server health, you might find our guide on Troubleshooting Windows Server helpful for general diagnostic procedures.

Configuring Folder-Specific Auditing

Enabling the global policy is only half the solution. You must explicitly tell Windows which folders to monitor. Navigate to the shared folder you want to track using File Explorer. Right-click the folder and select Properties. Switch to the Security tab and click the Advanced button near the bottom of the window. In the Advanced Security Settings dialog, go to the Auditing tab. Click the Add button to create a new audit entry. In the Select User or Group field, type Everyone to capture access from all users, or specify particular groups like Domain Users if you prefer granular control. Click Check Names to validate the selection, then click OK. Back in the Auditing Entry window, configure the types of access to audit. Ensure that Full Control, Read, and Write are checked under "Basic permissions" or manually select the corresponding advanced permissions. Crucially, check both Success and Failure to record successful accesses and denied attempts. Click OK to save the entry. Repeat this process for any other shared folders requiring monitoring. This explicit configuration overrides the default behavior and directs the operating system to log events specifically for these paths.

Locating and Interpreting Logs

Once auditing is configured, data begins accumulating in the Windows Event Viewer. Open Event Viewer from the Start menu. Expand Windows Logs and select Security. The logs are dense, so filtering is essential. Right-click the Security log and choose Filter Current Log.... In the filter window, locate the field labeled All Event IDs. Enter 5140 for share access events (when a user connects to the shared folder) or 4663 for file-level access events (when a user opens, reads, or writes to a file within the folder). You can also filter by the specific file path if needed, though this requires more complex XML queries. Click OK to apply the filter. Each event provides detailed information. Look at the Description field for the account name, IP address, and the specific action performed. The Subject section shows who initiated the request, while the Object section details the target file or folder. Understanding these fields allows you to pinpoint unauthorized access or troubleshoot permission errors. If you encounter connectivity issues alongside access problems, reviewing network diagnostics may be necessary, such as those discussed in our article on Can't Ping AWS Site-to-Site VPN Windows Server Customer Gateway: Troubleshooting Guide.

Managing Log Growth and Performance

Continuous auditing generates significant log data, which can fill up the Security log quickly and impact performance. It is vital to implement log rotation and retention policies. In Event Viewer, right-click the Security log again and select Properties. Set a maximum size limit, such as 500 MB or 1 GB, depending on your storage capacity. Choose whether to archive the log when full or overwrite older events. For long-term analysis, consider exporting logs to a centralized logging server using Windows Event Forwarding or a third-party SIEM solution. This prevents local log tampering and allows for better correlation with other security events. Regularly review these logs to identify patterns of misuse or configuration drift. Proper management ensures that your auditing strategy remains sustainable and effective over time.

Frequently Asked Questions

Why can't I see the Auditing tab in Folder Properties?

The Auditing tab appears only if the NTFS volume supports auditing and if you have administrative permissions. Ensure you are running File Explorer as an administrator and that the drive is formatted with NTFS. If the tab is missing, verify that the Advanced Audit Policy has been enabled via Group Policy.

Does auditing shared folders affect server performance?

Minimal impact occurs during normal operations, but heavy write loads combined with extensive auditing can increase CPU and disk I/O usage. To mitigate this, limit auditing to critical folders rather than entire drives and optimize your log retention policies to prevent excessive disk consumption.

How do I stop auditing a specific folder?

To remove auditing, return to the folder's Properties > Security > Advanced > Auditing tab. Select the existing audit entry and click Remove. Confirm the removal. Note that removing the entry stops future logging but does not delete previously recorded events from the Event Viewer.

What is the difference between Event ID 5140 and 4663?

Event ID 5140 logs network share access, indicating when a user connects to the shared resource itself. Event ID 4663 logs file-level access, recording actions like opening, reading, or writing individual files within that share. Use 5140 for broad access monitoring and 4663 for detailed file activity tracking.

Can I audit folders on a workgroup server without Active Directory?

Yes, you can configure auditing on standalone servers using Local Security Policy instead of Group Policy. The process remains identical: enable Audit File System in Local Security Policy and configure folder-specific auditing via NTFS permissions. However, you cannot centralize logs easily without additional tools.