How to audit Windows file and folder access with native tools. Windows provides native tools for auditing file and folder access, but they require proper configuration to be effective. MSPs need a structured approach to generate meaningful logs without overwhelming systems. In this video, we'll outline how to audit file and folder access using native Windows tools. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. How to audit Windows file and folder access. Enable advanced audit policy. Begin by enabling advanced audit policies on file servers. First, configure a group policy object to enable audit file system for both success and failure events under Advanced Audit Policy Configuration, Object Access. This ensures that file system access events are generated consistently for objects that have appropriate SACLs configured. From there, additional auditing for policy changes and account activity can improve traceability. Validate the configuration using auditchannelpol/get/category:* to confirm that policies are applied correctly. Apply system access control lists, SACLs, strategically. Define exactly which files and folders should generate audit events. Focus on high-value directories such as shared drives, sensitive data repositories, or business-critical folders. Configure auditing entries to track relevant actions such as creating files or folders, writing data, deleting objects, reading attributes, and changing permissions. Avoid applying SACLs broadly across entire volumes unless absolutely necessary. Overly broad SACLs generate excessive logs, making analysis difficult and reducing signal quality. Centralize and normalize logs. Relying on local logs is not scalable or audit-friendly. Use Windows Event Forwarding or a Windows Event Collector server to centralize security logs. From there, normalize key fields such as user identity, file path, server name, access type, and result. Proper normalization ensures logs are searchable and usable for both investigations and reporting. Retention policies should also be configured to align with compliance and operational review cycles. Create detections and alerts. Convert raw logs into actionable alerts. Focus on high-risk patterns such as bulk deletions or permission changes. Monitor for unusual access patterns, such as new or external identities accessing protected paths. Additionally, track share-level anomalies such as Event ID 5145 activity originating from unexpected systems or IP addresses. Alerts should align with clear investigation workflows to enable quick response. Report and review. Regular reporting ensures auditing remains effective. Generate monthly summaries that highlight key activity, including top users accessing files, frequently accessed paths, permission changes, and failed access attempts. This provides both operational insight and audit evidence. Review exceptions and ensure they have defined expiration dates. Adjust SACL configurations over time to reduce noise and improve signal quality. Native Windows auditing can provide strong visibility when it is configured correctly. MSPs can build an audit-ready, scalable monitoring framework by combining policy configuration, targeted auditing, and centralized analysis. For more information, check out our official blog post on how to audit Windows file and folder access with native tools, linked in the description below.