How to audit changed / deleted files - ver 1.25

Audit changed or deleted files on your Windows file server. This script makes a daily report in HTML, featuring search-as-you-type results.

5 Star
8,382 times
Add to favorites
E-mail Twitter Digg Facebook
  • Eroor $TimeSpan = -((New-TimeSpan -Start $Time
    1 Posts | Last post February 05, 2016
    • Don't work. error. 2008R2 and 2012R2
      New-TimeSpan : Не удается привязать параметр "Start" к целевому объекту. Исключение при задании "Start
      Объект не указывает на экземпляр объекта."
      C:\audit\Functions.ps1:52 знак:44
      +         $TimeSpan = -((New-TimeSpan -Start $Time -End $Pending_Delete[$Key].Time ...
      +                                            ~~~~~
          + CategoryInfo          : WriteError: (:) [New-TimeSpan], ParentContainsErrorRecordException
          + FullyQualifiedErrorId : ParameterBindingFailed,Microsoft.PowerShell.Commands.NewTimeSpanCommand
  • How Can I Avoid C Drive from Auditing
    1 Posts | Last post February 01, 2016
    • Dear Jeremy ,
      I have 2 Queries
      1 . How Can I avoid 1 whole drive from Auditing  
      2. Why I am getting the message "Unable to convert an event to XML" Message what does this message means and how can I get rid of this message 
      Thanks in Advance ,
      Rengith George
  • Exclude operations on types of files
    2 Posts | Last post January 22, 2016
    • Does anyone know if it's possible to exclude operations on types of files?
      Example: exclude created/modified for .pst files. We only care if they get moved or deleted.
    • I did figure out how to exclude the pst files by adding it to Line 16 in Variables.ps1.
      Best case is still to include the pst (or any chosen file extension) files, but only if they have been renamed or deleted.
  • Running more often then once a day
    1 Posts | Last post January 22, 2016
    • If anyone can show how we can run this more often then once a day and also be able to combine the previous X amount of log entries, that would be much appreciated.
      run every 30 minutes
      add to current HTML/CSV files instead of generating new ones
  • Moves not being recorded on Windows 8
    3 Posts | Last post January 05, 2016
    • I followed your setup directions to a T on a Windows 8 machine.
      All my moves are just being recorded as deletes with a source.
      No matter what I do destination is always empty.
      I just stumbled on your script today and I see you just updated it a few days ago.
      Maybe a minor bug, or at least one effecting Windows 8 in the new release?
      I'll try it on 2008 R2 tomorrow if I have a chance.
    • Hi Kenny,
      I just did a quick test of moving a file from one folder to another using version 1.25 of the script on Server 2012 R2 with a Windows 8.1 PC and it reported a move correctly.
      Keep in mind that the script is designed to run on Windows Server and report changes made by workstations to files on that server.
      Thanks for commenting!
    • Hi Jeremy Robb
      thanks for this script is very useful and use it on file server 2012 and all work except moved file from folder to another folder not record in destination but renamed work I hope u help me
      thanks alot
  • Copy to a non audited folders
    2 Posts | Last post December 22, 2015
    • Thank you for the script. it is very useful. works great on w2012R2.
      there is any way to audit copying files to folders outside the network, and display on the report? it is logical that not indicate the destination , but at least you have accessed the file to copy it ?
    • Nice script shared.
      I would be adding another informative PDF guide that covers all the required steps in order to enable auditing on file server and track every critical changes/access into real time :
31 - 36 of 36 Items