Is there any logging mechanism in Windows XP to know whether a user has done a specific file operation (create/modify/delete)?


Yes you can and it's called Auditing. You can audit for succesfull and/or failed attempts. To enable auditing you have to take 2 actions:

  1. Enable auditing by a policy. You have to open local Security Policy (or a policy on a domain) and go to Local Policies -> Audit Policy -> Audit object access. Check either Success or Failed, or both.

  2. Enable auditing on a file or folder Now auditing is enabled, you have to set which files are audited. To do so rightclick on the file or folder that you want to audit and choose properties. Go to the security tab and click Advanced. Here you have to select for which users you want to enable auditing. Next you have to check for with actions you want to enable auditing.

You can find the results in the security eventlog.

| improve this answer | |
  • This isn't strictly correct. What the audit log will show you is that files have been opened (or that open attemps failed) for the types of access specified. It does not record actual read, write, etc., operations. For example, a program could open a file for read/write access and then only perform read operations, but the Security log will show that the file was opened for read and write. For that matter the file could be opened and then nothing at all actually done to it; the Security log will still show that the file was opened for read and write. – Jamie Hanrahan Oct 10 '15 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.