Auditing File Access on Windows XP Shared Folders

In Windows XP Professional, tracking user activity on shared network folders was achieved by combining the operating system's Local Security Policy with NTFS-level file auditing. By enabling the "Audit object access" policy and defining System Access Control Lists (SACLs) on specific folders, administrators could generate detailed logs of every read, write, modify, or delete attempt. These events were recorded directly into the Windows Security Event Log, providing a verifiable record of who accessed a shared file, when the access occurred, and whether the attempt succeeded or failed.

1. Disabling Simple File Sharing

To access the security and auditing controls required for tracking, administrators first had to disable Simple File Sharing, which was enabled by default in Windows XP Professional.

  1. Open My Computer, click Tools, and select Folder Options.
  2. Go to the View tab.
  3. Scroll to the bottom of the Advanced settings list and uncheck Use simple file sharing (Recommended).
  4. Click OK.

Disabling this feature exposed the "Security" tab in folder properties, enabling the configuration of granular access rights and audit rules.

2. Enabling the "Audit Object Access" Policy

Windows XP did not track file events by default to conserve system resources. Tracking had to be turned on globally through the operating system's security policies.

  1. Click Start, select Run, type secpol.msc, and press Enter to open the Local Security Policy console.
  2. In the left pane, expand Local Policies and select Audit Policy.
  3. In the right pane, double-click Audit object access.
  4. Check the boxes for Success, Failure, or both:
    • Success: Logs every time an authorized user successfully opens, modifies, or deletes a file.
    • Failure: Logs every time a user is denied access due to insufficient permissions.
  5. Click OK to apply the policy.

3. Configuring Folder-Level Auditing Rules (SACLs)

Enabling the global policy prepared the system to log events, but tracking only occurred on specific folders formatted with the NTFS file system where auditing was explicitly defined.

  1. Locate the shared folder on the host machine.
  2. Right-click the folder, select Properties, and go to the Security tab.
  3. Click the Advanced button to open the Advanced Security Settings dialog.
  4. Navigate to the Auditing tab and click Add.
  5. Type the name of the user or group to monitor (such as Everyone or Domain Users) and click OK.
  6. In the Auditing Entry window, check the specific actions to monitor for Successful or Failed attempts:
    • Traverse Folder / Execute File
    • List Folder / Read Data
    • Create Files / Write Data
    • Delete or Delete Subfolders and Files
  7. Click OK on all dialog boxes to save the configuration.

4. Viewing the Recorded Access Attempts

Once configured, Windows XP logged every matched access attempt to the Event Viewer.

  1. Click Start, select Run, type eventvwr.msc, and press Enter.
  2. In the left pane, select Security.
  3. Look for entries labeled with Event ID 560 (Object Access) or Event ID 567 (Object Access Attempt).
  4. Double-clicking an event revealed critical forensic details, including:
    • User Name: The account that attempted the access.
    • Object Name: The exact file or path that was targeted.
    • Accesses: The specific operation attempted (e.g., READ_DATA, DELETE).
    • Image File Name: The process or executable used to access the file.