Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any logging mechanism in Windows XP to know whether a user has done a specific file operation (create/modify/delete)?

share|improve this question
up vote 2 down vote accepted

Yes you can and it's called Auditing. You can audit for succesfull and/or failed attempts. To enable auditing you have to take 2 actions:

  1. Enable auditing by a policy. You have to open local Security Policy (or a policy on a domain) and go to Local Policies -> Audit Policy -> Audit object access. Check either Success or Failed, or both.

  2. Enable auditing on a file or folder Now auditing is enabled, you have to set which files are audited. To do so rightclick on the file or folder that you want to audit and choose properties. Go to the security tab and click Advanced. Here you have to select for which users you want to enable auditing. Next you have to check for with actions you want to enable auditing.

You can find the results in the security eventlog.

share|improve this answer
This isn't strictly correct. What the audit log will show you is that files have been opened (or that open attemps failed) for the types of access specified. It does not record actual read, write, etc., operations. For example, a program could open a file for read/write access and then only perform read operations, but the Security log will show that the file was opened for read and write. For that matter the file could be opened and then nothing at all actually done to it; the Security log will still show that the file was opened for read and write. – Jamie Hanrahan Oct 10 '15 at 19:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.