Windows 10: How do I find the folders on which Audit policy is enabled?

Hello,I enabled Audit policy on a folder to delete files and folders within it. I enabled Audit policy on a folder to delete files and folders inside it, but when I check the Security section in Event Viewer, I see that there are reports with ID 4663 for files like C:\Program Files x86\Kaspersky Lab\Kaspersky Security for Windows Server\kavfswp.exe and C:\Windows\System32\cmd.exe.How do I see a list of folders on which Audit policy is enabled?Thank you.

:)

 

Folder Auditing/Effective Access

Hi,



Thank you for writing to Microsoft Community Forums.



Yes, you will have to change the owner of the folder of file before changing the Effective access of a folder, if we don’t have the ownership and directly apply Effective Access, you will notice red cross on all the permission,
which means it is not applied.



You can apply audit policies
to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. To complete this procedure, you must be logged on as a member of the built-in Administrators
group or you must have been granted the Manage auditing and security log right.



Regards,

Amit Sunar

Microsoft Community – Moderator

 

Folder Auditing/Effective Access

Does taking ownership also apply to the auditing tab not just the effective access?

Would appreciate it if you can provide me with some clarification, again thanks in advance for your help!

 

Audit policy

Hi! I want to monitor user activities of each user, and I'm using winlogbeat on windows server VM to collect audit log. I enabled recommended policy following this link Audit Policy Recommendations

I haven't login the machine for days, but the log still show many processes created by my user. For example, C:\Windows\System32\svchost.exe is created. It's has user test2, but I did not login as test2 for weeks. Another example, C:\Windows\System32\cleanmgr.exe is created with my user test2, and I did not run that process.

So why does it have some created processes related to my user, while I did not do anything, and did not login? What does this mean? Thanks!