Technical Anshu
Tutorials Blog
🔍 File Auditing

Audit Who Opened or Deleted a Shared File with Event 4663

The file is gone from the shared folder, and the room has gone quiet. Without auditing, that question has no answer — only opinions. With auditing switched on, Windows keeps a written record of who opened, changed or deleted what, and when. This page sets it up before you need it.

✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 8 minute setup
🎥 Full video — auditing and access control for shared folders

Auditing is the part of sharing nobody sets up — until the first file disappears. It has two switches, and missing either one means no record: the audit policy on the PC, and an auditing entry on the folder itself. Both take five minutes. The result is Event ID 4663 in the Security log, naming the account, the file, and the action.

Event Viewer — Security Log, Event 4663 (example)
Event ID4663 — An attempt was made to access an object
Account NameOFFICE-PC\Ravi
Object NameD:\Billing\Invoice-March.xlsx
AccessesDELETE
ResultSuccess
⚠ Example values. A delete shows as a 4663 with the DELETE access, usually paired with Event 4660 (object deleted)
What a delete event looks like. Your log will show your own accounts, files and times.
1

Switch 1 — Turn on the Audit Policy

  1. Open secpol.msc → Advanced Audit Policy Configuration → Object Access
  2. Set Audit File System to Success (add Failure too if you also want refused attempts recorded)
  3. From an admin Command Prompt you can verify with auditpol /get /category:"Object Access" and set it with auditpol /set /subcategory:"File System" /success:enable /failure:enable

On a PC without secpol (Windows Home), the auditpol command alone can set the policy.

2

Switch 2 — Tell the Folder What to Record

  1. Folder Properties → Security → Advanced → Auditing tab → Add
  2. Choose the principal — the group whose activity you want recorded (or Everyone, for all users)
  3. Tick the actions that matter: Delete, Delete subfolders and files, Write, Change permissions
  4. Apply to "This folder, subfolders and files" so new files are covered too

Start narrow. Auditing every read on a busy folder creates thousands of events a day and buries the ones you care about.

3

Reading the Log After an Incident

  1. Open eventvwr.msc → Windows Logs → Security
  2. Use Filter Current Log → Event IDs 4663 (and 4660 for confirmed deletions), set the time window around when the file vanished
  3. Open the event: the Account Name is who, Object Name is the file, Accesses shows what they did (ReadData, WriteData, DELETE)

One practical detail: the Security log is only as deep as its size limit. On a busy PC, raise the maximum log size (right-click the log → Properties) or archive it regularly, or old events are overwritten exactly when you go looking for them.

4

The Honest Limits of Auditing

Auditing must be on before the incident — it records nothing backwards. It names the account, not the human: if the whole office shares one login, the log will blame that login, which is one more reason every person needs their own account. And a local administrator can clear the log (that act itself leaves Event 1102 — its presence is its own kind of evidence). Auditing is a strong office record, not court-grade proof against the PC's own admin.

🔴 Set this up today, not after the first incident. The most common auditing story in small offices is: file deleted on Monday, auditing enabled on Tuesday, answer needed about Monday. There is no way to recover that record — the five minutes only works in advance.

🎥 Watch the Full Video

The video covers auditing as part of the full access-control setup — policy, folder settings and the Security log, live.

▶️ Watch Full Video
❓ Common Questions (FAQ)

Will auditing slow the PC down?

For a normal office folder, not noticeably. Performance only suffers if you audit every read and write on a very busy folder — which is why this guide audits deletes and writes on the folders that matter, not everything.

Can I audit a folder shared from a Windows Home PC?

The folder Auditing tab exists on NTFS regardless of edition, and the policy can be set with the auditpol command even without secpol.msc. What Home lacks is the convenient policy editor, not the capability.

Someone deleted a file last month. Can auditing tell me who, if I enable it now?

No. Auditing records only events that happen after it is configured. For the old incident your only traces are things like the Recycle Bin (network deletes usually skip it), shadow copies, or your backup history.

This guide is based on the Technical Anshu advanced sharing video • Stuck on any step? Ask in the video comments — you will get a reply there 🙏