How to find out who changed the folder permissions (2024)

Native auditing

1. Setting up the file's auditsystem access control list (SACL):

Select thefile you want to audit and go toProperties. Select theSecurity tab→Advanced→Auditing→ Add.
Select Principal:Everyone; Type:All; Applies to:This folder, sub-folders, and files.
ClickShow Advanced Permissions,selectChange permissions andTake ownership.

2. Setting up your domain's audit policy

Go to yourGroup Policy management console, and edit theDefault Domain Policy.
Go toComputer Configuration→ Policies→ Windows Settings→ Security Settings.
Go toLocal Policies→ Audit Policy: Audit object access.Select bothSuccess andFailures.
Go toAdvanced Audit Policy Configuration→ Audit Policies→ Object Access:
- Audit File System:SelectbothSuccess andFailures.
- Audit Handle Manipulation:Select bothSuccess andFailures.
Go to Event Loganddefine the:
- Maximum security log size to1GB.
- Retention method for security log toOverwrite events as needed.

3. Checking for the event on yourEvent Viewer

Go to theWindows Security logs, and search for:

Simplifiedfolderpermission change monitoring with ADAudit Plus

With ADAudit Plus' simple, easy-to-read reports, a single click is all it takes to pull up complete details of who changed the file/folder permissions, when, and from which machine. The exact value of the permission changed is also listed. These reports can be exported andscheduled to be automatically generated at the specified times and delivered to yourinbox. You can also configure alerts to notify you when permissions of critical files/folders are changed. This way you can take action immediately.

Login toADAudit Plus. Go totheFile Audit tab, andunderFile Audit Reports, navigate totheFolder Permission Changes report.

The details you can find in this report include the:

File/folder name and its location in the server
Name of the user who modified the permission
Values of new and oldaccess control list (ACL)
Permissions modified
Server in which the file/folder is located
Time at which the permission was changed

To understand what exactly was changed in the file/folder's ACL, click theMore link in thePermission Modified field.

The new and old values of your ACL are also provided in detail.

Old ACL:

New ACL:

Note that in this example, Mark Lloyd has been given full control during this permission change. With these details, you can investigate further if you think the permission change seems malicious. If you want to filter the permissions changed based on the server in which the files/folders reside, simply switch toServer Based Reports and navigate to theFolder Permissions Changed report. A similar reportfiltered based on the server you choose is displayed. To view the permission changes made by a specific user, go to theUser Based Reports, and select theFolder Permissions Changed report.

Keeping track of your files' and folders' permission changes is critical in maintaining file integrity and preventing unauthorized access.

The steps above answer the following file/folder permission monitoring questions:

Find out who changed permissions on a folder inWindows
How to check who changed folder permissions
How to see who changed folder permissions
How to tell who changed folder permissions
Who changed file permissionWindows
Check who changed file permissions
How to audit file permission changes
How to find out who changed folder permissions
Software: how to find out who changed folder permissions
How to find out whochanged the folder permissions inWindows 2003
How to find out who changed folder permissionsWindows 2008 R2
How find out who changed folder permissions inWindows 2008
How to find the folder-level permission changes inWindowsServer 2003
How to track the folder permission changes inWindows file server
How to track if file and folder permissions changed on a server
How to audit folder permission changes
How to find out who changed permissions of a folder onaserver
How to find who changed shared folder permissions
How to monitor changes to files and folder permissions
How to check folder permissions changes inWindowsServer
How to check who change folder access permissions