Getting File audit settings

This topic contains 4 replies, has 4 voices, and was last updated by Profile photo of Toby Hessellund Toby Hessellund 11 months ago.

  • Author
    Posts
  • #23238
    Profile photo of ertuu85
    ertuu85
    Participant

    Hello,

    I've found several sites that show how to set the file audit settings...but I haven't had much luck finding any information about retrieving audit settings on a particular folder...

    I'm trying to write a health check script that will verify certain file auditing is in place such as....

    %systemroot% has audits set up for 'failures' on 'CreateFiles" for the 'everyone' user. I know how to set this up using:

    New-Object System.Security.AccessControl.FileSystemAuditRule("Everyone","CreateFiles”,"none","none",”Failure")

    But I'm unsure how to query a folder and get it's audit settings for a particular user (almost 'everyone' user in my case).

    Any help or tips would be greatly appreciated.

  • #23239
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    You'd use the Get-Acl command with the -Audit switch to retrieve the folder or file's current settings:

    $acl = Get-Acl C:\Some\Folder -Audit
    $acl.Audit
    
  • #23240
    Profile photo of ertuu85
    ertuu85
    Participant

    God I feel dumb lol....

    That was very easy, thanks again for such a direct and easy solution!

  • #33642
    Profile photo of Patrick Burwell
    Patrick Burwell
    Participant

    So how do you check access to a file?

  • #33649
    Profile photo of Toby Hessellund
    Toby Hessellund
    Participant

    $acl.Access

You must be logged in to reply to this topic.