> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/file-integrity-monitoring-fim/how-can-i-monitor-object-access-on-windows-systems-with-enginsight.md).

# How can I monitor object access on Windows systems with Enginsight?

On Windows systems, you can use Enginsight to monitor access to sensitive files and directories and receive alerts when something unusual happens. To do this, you first need to enable object access auditing via a local or domain-wide Windows Group Policy and define which folders or files you want to monitor.

In the following article, we will show you step by step which settings you need to configure on your Windows system and how you can view the results in Enginsight.

{% hint style="warning" %}
**Please note**: Only enable object access auditing on Windows systems where you actually want to use this function. In some cases, Windows generates events for folders that you have not selected for monitoring. This can lead to unwanted false alarms.
{% endhint %}

***

## Settings in Windows

{% hint style="info" %}
In the following example, we show you how to enable a local Group Policy. It is also possible to enable object access auditing via a domain-wide Group Policy.
{% endhint %}

{% stepper %}
{% step %}

### Enable object access auditing in Group Policy

1. Log in to your Windows system and open the **Editor for Local Group Policies** (**gpedit.msc**).
2. Navigate to **Computer Configuration** → **Windows Settings** → **Security Settings** → **Local Policies** → **Audit Policy**.
3. Open the policy **Audit object access**.
4. The window **Audit Object Access Properties** opens on the **Local Security Setting** tab.
5. Select the checkboxes next to **Success** and **Failure**.
6. Confirm the settings.
7. Navigate to the Windows Command Prompt (CMD) and apply the Group Policy with the following command:

```
gpupdate /force
```

{% endstep %}

{% step %}

### Define files and folders for monitoring

1. Navigate to the file server on which you want to monitor object access.
2. Open the **Properties** of the folder or file that you want to monitor.
3. Switch to the **Security** tab and click **Advanced**.
4. In the window that opens, switch to the **Auditing** tab and click **Add**.
5. In the field where you can add object names, enter **Everyone**.
6. Click **Advanced**.
7. Select all checkboxes under **Advanced permissions**.
8. Confirm the settings.
9. Select the new auditing entry by clicking it and select the checkbox next to **Replace all child object auditing entries with inheritable auditing entries from this object**.
10. Click **OK** to complete the configuration.
    {% endstep %}
    {% endstepper %}

## View Object Access Events in Enginsight

Once you have enabled object access auditing, you can view the corresponding log entries in the Enginsight platform under **Hosts** → [System Events](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/management/system-events).

{% hint style="warning" %}
**Please note**: For values to be displayed here, system event logging must be enabled in the [settings of the individual hosts](https://docs.enginsight.com/docs/manual/english/platform-usage/host-detail-view/settings) or under **Hosts** → [Policy Manager](s://docs.enginsight.com/docs/manual/english/platform-usage/hosts/management/policy-manager) with a corresponding policy.
{% endhint %}

{% hint style="success" icon="lightbulb-exclamation" %}
For more information on how to create a policy manager in the Enginsight platform, see the Enginsight Manual: [Add Policy Manager](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager)
{% endhint %}

{% stepper %}
{% step %}

### Navigate to System Events

Log in to the Enginsight platform and navigate to **Hosts** → **Management** → **System Events**.
{% endstep %}

{% step %}

### Filter the system events list

Click the **Filter** icon <i class="fa-filter">:filter:</i> above the list to filter the list by predefined parameters.

Select the **Category** filter to display all available system event categories. Select the **Audit Object Access** category to filter the list by the corresponding logged system events.

To display only specific object access events, you can further filter the list. To do this, click the **Filter** icon again and select the **Subcategory** filter.

The following subcategory filters are available:

* **Audit Object Delete Access**: A file or folder was deleted.
* **Audit Object Create Access**: A file or folder was created.
* **Audit Object Modify Access**: The content or metadata of a file or folder was changed.
* **Audit Object Read Access**: A file or folder was read.
  {% endstep %}

{% step %}

### Configure alerts

To be informed about unusual or unauthorized object access, you can add two alerts for hosts.

{% hint style="success" icon="lightbulb-exclamation" %}
For more information on how to create an alert in the Enginsight platform, see the Enginsight Manual: [Add Alert](https://docs.enginsight.com/docs/manual/english/platform-usage/alerts/overview/add-alert)
{% endhint %}

<table><thead><tr><th width="271.70703125">Alert</th><th>Description</th></tr></thead><tbody><tr><td>Object access outside business hours</td><td>Define a time period during which access to directories and files usually takes place. The alert is triggered if access occurs outside this period.</td></tr><tr><td>Unauthorized object access</td><td>Define users who are allowed to access directories and files. Specify the users in the format <strong>&#x3C;Domain>\&#x3C;Username></strong> (for example, AzureAD\MaxMustermann). The alert is triggered if a user who is not explicitly defined here accesses objects.</td></tr></tbody></table>
{% endstep %}
{% endstepper %}

***