Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I'm the administrator of my computer can I view for example if someone opened a file, used a program, visited a website or did some action?

In other words is there a way to monitor the complete activity in my computer (Win7) without any third-party software?

share|improve this question
up vote 4 down vote accepted

You cannot if you have Windows 7 Home versions, but if you Have Windows 7 Pro or Ultimate, you can.

Open gpedit.msc and go to:

Computer Configuration>Windows Settings>Security Settings>Local Policies>Security Options

enter image description here

Enable any of the Audit policies, but especially "Audit: Force audit policy subcategory settings".

Then go to:

Computer Configuration>Windows Settings>Security Settings>Advanced Audit Policies Configuration>System Audit Policies – Local Group Policy>Object Access

Set the "Audit File System Policy" to configure both Success and Failure events. Do a gpupdate/force at an elevated command prompt.

Next go to the folder(s) you want to audit, and go to Properties>Security>Advanced>Auditing>Edit>Add and add whoever you want to audit. If you do this at the root of the drive, it will inherit all the way down unless inheritance has previously been blocked. After you hit Add and select them, you will be presented with a box to select what you want to audit. Click Full control for both Success and Failure.

enter image description here

All file accesses should now show in your Event Viewer>Windows Logs>Security node.

To answer your question below: Obviously the amount of data being collected for every file access can be voluminous. If you have your accounts well password protected, most administrators just look for access failures to see if people are trying to access material they are not entitled to. If you are trying to monitor kids at home, probably better is to use the Parental Controls feature linked here. Otherwise you need to use the filter options in the right pane.

enter image description here

share|improve this answer
Thank for the great tutorial! I created some folders and a new user in order to do some tests, but I'm having trubles to find events in "Event Viewer>Windows Logs>Security node" related to the user who edits or opens files, how I can distinguish this kind of events? – mt22 Jul 30 '11 at 19:01
I added to the answer. – KCotreau Jul 30 '11 at 19:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .