7 Ways to Monitor Shared Folders For Who Modified or Deleted Files

5. System Tray Share Monitor

System Tray Share Monitor

This tool was first released on 2002, last updated in 2007 and designed to work on Windows XP but still works in Windows 7. Upon running, System Tray Share Monitor monitors and logs incoming connections and the files that are being read and written. There is no notification and double clicking on the tray icon will show a small bar of the user and IP address connected to your shared folder. Double clicking on the user name will bring up another window showing the files currently being accessed.

Download System Tray Share Monitor


6. WhoIsConnected

WhoIsConnected

WhoIsConnected comes with a unique feature called “Disable Login” which is very useful if you want to quickly stop anyone from accessing your shared folders with a single click of a mouse button. Unfortunately Disable Login feature only works on Windows XP but not on Vista and 7. The connection notification can be enabled from the Options window where a notification window will be displayed when someone accesses your shared folder. There is no log support on this tool.

Download WhoIsConnected


7. The Manual Way

If you’ve gone through all 6 programs above, you may have noticed that there is no perfect tool that comes with all features to monitor your shared folders such as logging, notification, actions and etc. Although they can all tell which files are being accessed and who is accessing them, it is still not possible to show the exact actions by the users such as if the files are being copied or deleted since it only shows read or written. If you need detailed logging information, there is actually a way to enable auditing without using third party tools but it requires more steps. Here is how to do it in Windows 7.

1. Click on the Start button, type Local Security Policy and press Enter.

2. Expand Security Settings > Local Policies > Audit Policy > and double click on Audit Object Access.

3. Tick on the Success checkbox and click OK.

Audit Object Access

4. Right click on the shared folder that you want to monitor and select Properties.

5. Go to Security tab and click the Advanced button.

6. Go to Auditing tab and click the Edit button.

7. Click the Add button, type EVERYONE at the object name box and click OK.

8. An auditing entry window will open allowing you to log the actions that you want. If you want to monitor deletion of files and folders, simply tick the “Delete subfolders and files” and “Delete” successful checkboxes. Do not tick everything because that will easily fill up the event logs making it harder for you to audit.

Auditing Entry

Whenever a file on the shared folder which you have enabled auditing is deleted, it will be logged and can be viewed from Event Viewer. Go to Control Panel > Administrative Tools > Event Viewer. Expand Windows Logs and click on Security. The event below is an example of a file x-ray.exe being deleted from the shared folder by the 192.168.2.17.
Event Viewer Audit Success

17 Comments - Write a Comment

  1. Veeravalli KoteswaraRao 1 year ago
  2. Robin form india 1 year ago
  3. Rohit 1 year ago
  4. Amit 2 years ago
  5. dk 2 years ago
  6. Swapnil 4 years ago
  7. vishnu 4 years ago
  8. KCM 5 years ago
  9. zurd0 8 years ago
  10. Angela 8 years ago
  11. billy13 8 years ago
  12. hanan 8 years ago
  13. Amir 8 years ago
  14. Rekhyt 8 years ago
  15. ha14 8 years ago
  16. pitaya 8 years ago
  17. umar 8 years ago

Leave a Reply

Your email address will not be published. Required fields are marked *

Note: Your comment is subject to approval. Read our Terms of Use. If you are seeking additional information on this article, please ask in our forum or contact us directly.