Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there any logging mechanism in Windows XP to know whether a user has done a specific file operation (create/modify/delete)?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Yes you can and it's called Auditing. You can audit for succesfull and/or failed attempts. To enable auditing you have to take 2 actions:

  1. Enable auditing by a policy. You have to open local Security Policy (or a policy on a domain) and go to Local Policies -> Audit Policy -> Audit object access. Check either Success or Failed, or both.

  2. Enable auditing on a file or folder Now auditing is enabled, you have to set which files are audited. To do so rightclick on the file or folder that you want to audit and choose properties. Go to the security tab and click Advanced. Here you have to select for which users you want to enable auditing. Next you have to check for with actions you want to enable auditing.

You can find the results in the security eventlog.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.