How to know who accessed my files in Windows 7?

How to know who accessed my files in Windows 7?

What you want to do is, Audit accessed shared files of your computer. There is a feature in Windows 7 that you can enable to have an Account Auditing to your computer. You can easily monitor all the events that happened on your computer which will help your computer system more secure. An audited log includes different events

Account Management will let you track who enable or disable account name as well as who changed it. In this event you can monitor also who created or deleted a certain account on your computer; this includes changing password and modifying user group. Another event is the Directory service access and Object access that you need to monitor who accessed any Active Directory on your network and who access or modifies your files and folders and even who accessed the printer.

You can also monitor who logged or turn off the PC through Logon events. The Policy change will let you see who tries to change the settings of your local security policies, including the auditing and trust policies. The System events will let you monitor who tries to open a certain program without any permission. It will also work if a Malware will try to modify your system and the Privilege use will allow you to observe who execute a task and whether they have permission to do it on the computer and the Process tracking event to see who execute or activates any program or processes on the computer.

To be able to perform these tasks you need to do some group policy editing:

1. Access the Group Policy Editor by selecting Start and typing gpedit.msc on the search field.
2. Navigate to Audit Object Access by going to Local Computer Policy to Computer Configuration, to Windows Settings, to Security Settings and Local Policies.
3. Double click the Audit Object Access to enable editing of content.

4. Under “Audit these attempts” option. Check the box “Success” and “Failure” and close the Editor.
5. Select the “Security” tab and open the properties of a shared folder that you want to monitor and click the “Advanced” button.

6. Under the “Auditing “tab click the “Continue” button.
7. Click “Add”, another dialog box will appear.
8. Click the “Locations” button to select a location that you want to monitor.
9. Click OK to exit from Group dialog and click OK twice to exit the Folder Properties.
10. To be able to view the Audit log, just type on the search field of start menu the “Event Viewer” under it select the “Windows Logs”.