Detecting Changes to File Shares via Native Tools

Описание: 1. Configure audit settings in your shared folder’s properties "advanced security settings"
"auditing" tab

2. Configure Domain controllers policy GPO. Enable “Audit object access” policy setting for success and failure.

3. Optionally for Windows Server 2008-2012 configure granular audit policy. Set “Audit File System” and “Audit Handle Manipulation” settings to success and failures.

To learn more, check https://www.netwrix.com/detecting_fil...