How to Track Who Accesses a Folder in Windows 10 and 11

Windows can log every time someone opens, edits, or deletes a file inside a folder, you just need to enable the right auditing settings. It’s a two-step process: turn on File System auditing system-wide, then configure which folder to watch.

Step 1: Enable File System Auditing

You’ll need administrator rights for this step. Windows 10 and 11 Home editions don’t include the Local Group Policy Editor (gpedit.msc), so skip to Option B below. Pro, Enterprise, and Education users can choose either option.

Option A: Advanced Audit Policy via Group Policy (Pro/Enterprise/Education)

1. Press Windows + R, type gpedit.msc, and press Enter.

2. Navigate to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access.
3. Double-click Audit File System.
4. Check Configure the following audit events, then check Success. Add Failure if you also want to log denied access attempts.
5. Click OK.

6. Open an elevated Command Prompt or PowerShell window and run gpupdate /force to apply the policy immediately.

Option B, auditpol.exe (all editions, including Home)

1. Right-click Start and select Terminal (Admin) or Command Prompt (Admin).
2. To enable auditing of successful file access, run:

AuditPol.exe /set /category:"Object Access" /subcategory:"File System" /success:enable

3. To also log failed access attempts, add /failure:enable:

AuditPol.exe /set /category:"Object Access" /subcategory:"File System" /success:enable /failure:enable

4. Confirm the setting took effect:

AuditPol.exe /get /category:"Object Access"

Find the File System row in the output. It should show Success (and Failure if you enabled it), not No Auditing.

Step 2: Configure Auditing on the Folder

Now tell Windows which folder to watch.

1. In File Explorer, browse to the folder you want to monitor.
2. Right-click it and choose Properties.
3. Click the Security tab.

4. Click Advanced.
5. In Advanced Security Settings, select the Auditing tab.

6. Click Add. If Windows shows a Continue button first, click it, as it’s asking for elevated permission to edit auditing entries.
7. Click Select a principal.
8. Type Everyone to audit all users, or enter a specific username or group, then click Check Names > OK.

9. Set Type to Success, Failure, or All; match this to what you chose in Step 1.
10. Under Basic permissions, check what you want to audit. Write and Delete cover the most important cases. Checking Full control logs everything, but it generates a high volume of events on any busy folder.
11. Set Applies to to This folder, subfolders and files.
12. Click OK > Apply > OK to close all dialogs.

Step 3: View Access Events in Event Viewer

1. Press Windows + R, type eventvwr.msc, and press Enter.
2. In the left pane, expand Windows Logs and select Security.

3. Right-click Security and choose Filter Current Log.
4. In the Event IDs field, type 4663. This is the event Windows writes each time a file or folder is successfully accessed. Click OK.

5. Double-click any event to open it. The fields you care about:

– Subject > Account Name: who accessed the file – Object > Object Name: the full path to the file – Accesses: what they did (READ, WRITE, DELETE, etc.)

Here’s an example of a delete event:

Subject:
  Account Name:    JaneDoe
  Account Domain:  DESKTOP-XY12345

Object:
  Object Type: File
  Object Name: C:\Users\JaneDoe\Documents\Reports\Q3_Final.xlsx

Access Request Information:
  Accesses: DELETE

And here’s an event for a file opened in Excel:

Object:
  Object Name: C:\Users\JaneDoe\Documents\Reports\Q3_Final.xlsx
  Process Name: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

Access Request Information:
  Accesses: ReadData (or ListDirectory)
             WriteData (or AddFile)
             ReadAttributes

The Process Name field shows which application opened the file. That’s handy for spotting an unexpected program accessing sensitive documents. It does take a little practice to read the events fluently, and running some test accesses on a dummy folder first helps you learn what normal activity looks like before you go hunting for something suspicious.

When You’re Not Seeing Any Events

If the Security log stays empty after you access the folder, check these three things:

• Policy not applied: Run AuditPol.exe /get /category:"Object Access" in an elevated terminal. If File System shows No Auditing, repeat Step 1 and run gpupdate /force.
• Folder auditing entry missing: Open the folder’s Properties > Security > Advanced > Auditing and confirm your entry is listed there.
• Type mismatch: If you enabled only Failure in Step 1 but you’re testing a successful access (or vice versa), nothing will appear. Enable both Success and Failure to catch all cases.

Monitoring a network share? Enable auditing on the machine that hosts the share, not your local PC. The events show up in that server’s Security log, not yours.

When Built-In Auditing Isn’t Enough

Event Viewer covers home and small-office needs well. For environments with multiple servers, long-term audit history, or compliance requirements, dedicated tools like IS Decisions FileAudit and Varonis add centralized dashboards, searchable histories, and real-time alerts, things Event Viewer can’t do without significant manual effort.

Conclusion

The auditpol.exe command in Step 1 works on every Windows edition, so if you’re not sure which version you have, start there. Once both steps are configured, filtering the Security log by Event ID 4663 shows exactly who accessed what and when. Keep the audit scope narrow, tracking only Write and Delete on sensitive folders keeps the log readable and avoids the performance overhead that comes with auditing every read on a heavily used directory.