Audit Who Opens a Shared Folder

Auditing is off by default, so event 4663 does not exist yet. Both success and failure matter: success shows **who got in**, failure shows who tried.

auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"File Share" /success:enable
auditpol /get /subcategory:"File System"

The SACL decides what gets recorded. Keep it on one folder with inheritance for its children; auditing a whole volume fills the log within minutes.

icacls D:\Share /audit "Everyone:(OI)(CI)(R,W,D)"
icacls D:\Share

Open a file in that folder while everything is still quiet. One known access proves the whole chain works before you interpret months of traffic.

Get-Content D:\Share\test.txt -ErrorAction SilentlyContinue
Start-Sleep -Seconds 5
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663} -MaxEvents 3 | Select-Object TimeCreated,Message

The object name is the file, the subject user is who touched it, and the **Access Mask** separates read from write from delete. Pull the fields from the XML instead of the formatted text.

$ev = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663} -MaxEvents 20
$ev | ForEach-Object {
  $x = [xml]$_.ToXml()
  [pscustomobject]@{
    Time   = $_.TimeCreated
    User   = ($x.Event.EventData.Data | Where-Object Name -eq 'SubjectUserName').'#text'
    Object = ($x.Event.EventData.Data | Where-Object Name -eq 'ObjectName').'#text'
    Access = ($x.Event.EventData.Data | Where-Object Name -eq 'AccessList').'#text'
  }
}

A file opened over SMB produces **5140** or **5145** as well as 4663. When time and path line up, the access came from the network rather than from the console.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140,5145} -MaxEvents 10 |
  Select-Object TimeCreated,@{n='Msg';e={($_.Message -split "`n")[0..3] -join ' '}}

The security log defaults to a few megabytes and overwrites itself. Raise the limit or the evidence is gone exactly when you need it.

wevtutil gl Security
wevtutil sl Security /ms:1073741824
Get-WinEvent -LogName Security -MaxEvents 1 | Select-Object TimeCreated,MachineName