Data visibility and security solution by ManageEngine DataSecurity Plus (2024)

1. Download and install DataSecurity Plus.
2. OpentheDataSecurity Plus console.
3. Navigate to Admin Console > Admin > Administrative Settings > Domain Settings and click + Add Domain in the top-right corner to add a new domain.
4. Provide theDomain Name along with itsusername and password. Addrequired domain controllers and clickSave.

5. To add file servers, navigate toFile Audit > Configuration andclick the + Add Serverbuttonlocatedin the top-right corner.
6. Selectyour domain andaddserversthat you want to audit.
7. Choose the files and folders to be audited fromSelect Objects to Monitor.
8. ClickInstall Agent and Finish. The agent is now installed successfully.

Under the File Audit tab, go to Access Audit and click All File/Folder changes report to get details on the who, when, and where of all the changes made to the files. To view all the read accesses made to the file, go to Access Audit under the File Audit tab and generate the Read Events report. You can apply filters here to view the data of a specific file.

1. Go to theFileAudittab.
2. Navigate to Configuration > General Settings > Custom Reports.

3. Click the Server Specific Reports within Custom Reports tab.
4. Provide asuitablereport name and description.
5. In theCriteria section,add the following filters:
   1. Action:All
   2. File Name: Enter the name of the file that you want to audit. (For this example, we'll name the file Employee data.)
6. ClickSave.

7. Navigate to Access Audit > Custom Server Reports.
8. Choose thecustom report that you just created.

1. LaunchtheGroup Policy Management consolethrough eitherof thesemethods:
   • Navigate toServer Manager > Tools > Group Policy ManagementConsole.
   • PressWin+R and in theRun dialog box that appears, typegpmc.msc and clickOK.
2. TheGroup Policy ManagementConsole windowwillopen. A new Group Policy Object (GPO) can be created, oran existing one can be modified.
3. If you want to add the group policy toan existing GPO, go to step 6.

4. To create a new GPO,right-click on the domain, site, or OU where you want to apply the policy and clickCreate a new GPOdialog in this domain andLink it here.
5. Enter a name for the GPO in theNew GPOdialog box and clickOK.

6. Nowright-click on that GPO and chooseEdit.
7. In theGroup Policy Management Editor,navigate toComputer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy

8. From the list ofauditpolicies,double-clickonAudit Object Access to open itsProperties.
9. Select theDefine these Policy Settings checkbox and thenchoose bothSuccess andFailureif you need to audit allthe accesses made on the object.
10. ClickApply and thenOK to close the window.

11. The GPO will be automatically updated.To update it manually,opentheCommand Prompt and typegpupdate/force and pressEnter. Now the GPO is updated.

1. Right-clickthefile(Employee_Data) that you want to auditand chooseProperties.
2. Go totheSecurity tab and clickAdvanced to open theAdvanced Security Settingswindow.
3. Go totheAuditing tab and clickAdd to create a new audit entry.TheAuditing Entry window appears.

4. Click onSelect a Principal and theSelect User, Computer, Service Account, or Group dialog box appears.
5. SelectEveryoneas the object name andclickCheck Names.
6. ClickOK to close the dialog box.

7. Choose the type of action you want to audit from the drop-down list.If you want to audit all successful and failed events,chooseAll.
8. This folder, subfolders and filesis selected by defaultin theApplies To option.
9. Under thePermissions section, selectFull controlandclickOK.
10. The new entry is now added. ClickApply andOK to close the window.
11. ClickOKin theProperties window.

1. OpentheEvent Viewer.
2. Navigate toWindows logs > Security.

3. Click on theFilter Current Log optionon the rightpane of the windowso theFilter Current Log window appears.
4. Under theTask category option, enter the eventID for which you want to view logs. When a file is accessed, theeventIDs 4656 and4663are logged. Enter these event IDs and clickOK.

5. Thefile access log is now displayed.
6. Tosearch for the access log for a particular file, clickFind...in the rightpane.
7. Provide the filenameand clickFind Next.
8. The firsthighlightedentryin the list has the latest timestamp.
9. Double-click on the highlighted log to view the access details.