Configuring object level auditing - Using PowerShell cmdlets

To audit file and folder access, object-level auditing must be enabled. This can be achieved in three ways:

• Using Windows shares
• Using PowerShell cmdlets
• Using Global Object Access Auditing

Using PowerShell cmdlets

• Create a CSV file containing the Universal Naming Convention (UNC) path or local path and the type of auditing (FIM) of all the folders that you want to enable auditing for.
• The CSV file should contain the list of folders in the following format: <folder>,<type> For example: E:\test folder,FIM \\SERVERNAME\c$\folder,FIM

Note: When removing object-level auditing for a set of folders, the <type>strong> parameter is not mandatory.

Once you have the CSV file that lists all the servers and the type of auditing required, go to the <Installation Directory>\bin folder within the PowerShell command prompt and type in: .\ADAP-Set-SACL.ps1 -file '.\file name' -mode add (or) remove -recurse true (or) false -username DOMAIN_NAME\username

Where:

For example

• To set object-level auditing for the list of folders in a CSV file named folders.CSV, use: .\ADAP-Set-SACL.ps1 -file '.\folders.CSV' -mode add
• To replace all subfolder object-level auditing settings with inheritable auditing settings applied to a CSV file named folders.CSV, use: .\ADAP-Set-SACL.ps1 -file '.\folders.CSV' -mode add -recurse true
• To remove object-level auditing for the list of folders in a CSV file named folders.CSV, use: .\ADAP-Set-SACL.ps1 -file '.\folders.CSV' -mode remove