How to See Who Changed File Permissions in Windows Servers

How to See Who Changed File Permissions in Windows Servers

Finding Permission changes on File Servers

Tracking user rights changes on Windows Servers is important because these changes can lead to unauthorized access and ultimately data exfiltration. IT administrators, therefore, must track permission changes to know who changed a permission, to which user, and, when. You can easily do it by enabling object access auditing and configuring the particular files and folders for auditing of changes in permissions. After you have enabled permission change audit, you can view and investigate all permission changes in Event Viewer. In this article, we discuss in detail about the native way of tracking permission changes. 

Enabling Object Access Auditing

  1. Open Local Security Policy.  Go to Administrative Tools and open Local security policy.
  2. Enable Audit Object Access policy.  In Local Security Policy, click on Local Policies, and then click Audit Policy. A List of all Local Security Policies are displayed in the right pane. 
  3. In the policy list, double click Audit Object Access to open the Properties window. 
  4. Select Success and Failure checkboxes. Click Apply and then OK.

Tracking Changes made to Permissions

  1. Locate the folders whose permission changes have to be tracked. Right-click on it and select Properties from the context menu.
  2. In the Properties window, switch to the Security Tab.  Click on Advanced to access the advanced settings.
  3. In the Advanced Security Settings, go on to the Auditing tab and click on Add to add a new auditing entry.
  4. In the Auditing Entry for Project Files window, click on the Select a Principal link to select users for auditing.
  5. As a best practice, choose every user as a principal. You can do so by typing 'Everyone' in the text box and click on Check and then OK.
This takes you back to the Auditing Entry window.  In the Type drop-down menu, select All. In the Applies To menu, select This folder, subfolders and files to configure permission change auditing to all files and folders in the selected folder.
  1. In the Basic Permissions check-box, select the necessary permissions that you want to audit.
  2. Click on OK and close the window.
  3. Then, click on Apply and then, OK to close the Advanced Security Settings for Project Files window. 

Viewing Changes on Event Viewer

Once the permission change auditing has been configured to the required folders, subfolders, and files, the system will log the events whenever it detects a change in permissions. You can view these logs from the Event Viewer.
  1. Open Control panel and then head to Administrative Tools. Then, Click on Event Viewer.
  2. Open the event logs and go to Windows Logs, and select Security.
  3. Select the Filter Current Log option and find specific event logs from all the logs on the file server.
  4. Search for the event ID 4670 that corresponds to permission changes on an object.
  5. After you have found the events, double-click any event to view its properties in the Event Properties window. Here, you'll find all the details related to the event.