1-949-407-5125

Why It Is Important

Any change of a file or folder owner is always alarming, as it can potentially result in leaks of sensitive data due to the owner’s ability to copy, modify, move to another location, delete or distribute confidential information it contains.

How to Detect Who Changed the File/Folder Owner

Native Auditing
1.
Navigate to the required file share, right-click it and select "Properties" Select the "Security" tab → "Advanced" button → "Auditing" tab → Click "Add" button
  • Select Principal: "Everyone"; Select Type: "All"; Select Applies to: "This folder, subfolders and files"; Select the following "Advanced Permissions": "Change permissions and "Take ownership".
2.
Run gpedit.msc Edit → "Default Domain Policy" → Computer Configuration → Policies → Windows Settings → Security Settings.
3.
Go to Local Policies → Audit Policy:
  • Audit object access → Define → Success and Failures.
4.
Go to "Advanced Audit Policy Configuration" → Audit Policies → Object Access:
  • Audit File System → Define → Success and Failures
  • Audit Handle Manipulation → Define → Success and Failures.
5.
Go to Event Log → Define:
  • Maximum security log size to 1gb
  • Retention method for security log to Overwrite events as needed.
6.
Open Event viewer and search Security log for event id 4663 with "File Server" or "Removable Storage" task category and with "Accesses: WRITE_OWNER" string. "Subject Security ID" will show you who changed the file’s/folders owner.
Netwrix Auditor for Windows File Servers
1.
Run Netwrix Auditor, navigate to Reports → File Servers → File Servers Activity → Select “File Server Changes” report → View.

Thank you for downloading the free trial!

Your download will begin in a moment. If it doesn't, please restart the download.

Meanwhile you can watch a 2-minute explainer video of Netwrix Auditor, an affordable change and configuration auditing platform for compliance, security and operations across the entire IT infrastructure.

Thank you for requesting the one-to-one demo!

We will get in touch with you soon.

Meanwhile you can watch a 2-minute explainer video of Netwrix Auditor, an affordable change and configuration auditing platform for compliance, security and operations across the entire IT infrastructure.