7 Ways to Monitor Shared Folders For Who Modified or Deleted Files

5. System Tray Share Monitor

System Tray Share Monitor

This tool was first released on 2002, last updated in 2007 and designed to work on Windows XP but still works in Windows 7. Upon running, System Tray Share Monitor monitors and logs incoming connections and the files that are being read and written. There is no notification and double clicking on the tray icon will show a small bar of the user and IP address connected to your shared folder. Double clicking on the user name will bring up another window showing the files currently being accessed.

Download System Tray Share Monitor

6. WhoIsConnected


WhoIsConnected comes with a unique feature called “Disable Login” which is very useful if you want to quickly stop anyone from accessing your shared folders with a single click of a mouse button. Unfortunately Disable Login feature only works on Windows XP but not on Vista and 7. The connection notification can be enabled from the Options window where a notification window will be displayed when someone accesses your shared folder. There is no log support on this tool.

Download WhoIsConnected

7. The Manual Way

If you’ve gone through all 6 programs above, you may have noticed that there is no perfect tool that comes with all features to monitor your shared folders such as logging, notification, actions and etc. Although they can all tell which files are being accessed and who is accessing them, it is still not possible to show the exact actions by the users such as if the files are being copied or deleted since it only shows read or written. If you need detailed logging information, there is actually a way to enable auditing without using third party tools but it requires more steps. Here is how to do it in Windows 7.

1. Click on the Start button, type Local Security Policy and press Enter.

2. Expand Security Settings > Local Policies > Audit Policy > and double click on Audit Object Access.

3. Tick on the Success checkbox and click OK.

Audit Object Access

4. Right click on the shared folder that you want to monitor and select Properties.

5. Go to Security tab and click the Advanced button.

6. Go to Auditing tab and click the Edit button.

7. Click the Add button, type EVERYONE at the object name box and click OK.

8. An auditing entry window will open allowing you to log the actions that you want. If you want to monitor deletion of files and folders, simply tick the “Delete subfolders and files” and “Delete” successful checkboxes. Do not tick everything because that will easily fill up the event logs making it harder for you to audit.

Auditing Entry

Whenever a file on the shared folder which you have enabled auditing is deleted, it will be logged and can be viewed from Event Viewer. Go to Control Panel > Administrative Tools > Event Viewer. Expand Windows Logs and click on Security. The event below is an example of a file x-ray.exe being deleted from the shared folder by the
Event Viewer Audit Success

18 Comments - Write a Comment

  1. Beecham 5 years ago
  2. Veeravalli KoteswaraRao 6 years ago
  3. Robin form india 6 years ago
  4. Rohit 6 years ago
  5. Amit 7 years ago
  6. dk 7 years ago
  7. Swapnil 9 years ago
  8. vishnu 9 years ago
  9. KCM 10 years ago
  10. zurd0 13 years ago
  11. Angela 13 years ago
  12. billy13 13 years ago
  13. hanan 13 years ago
  14. Amir 13 years ago
  15. Rekhyt 13 years ago
  16. ha14 13 years ago
  17. pitaya 13 years ago
  18. umar 13 years ago

Leave a Reply

Your email address will not be published. Required fields are marked *

Note: Your comment is subject to approval. Read our Terms of Use. If you are seeking additional information on this article, please contact us directly.