File Monitoring

Choose the kind of file information you need. In NeQter, these collection methods have different purposes:

The Windows workflow below applies to the server that hosts the files. A file server does not have to be a domain controller. A standalone Windows server can use local audit policy instead of a domain GPO; Microsoft describes both approaches in its advanced audit-policy reference.

Prepare agent collection

Install the current NeQter agent on each file server and confirm it appears under Hosts → Agents. In the Groups view, open its Edit group → Logs → Windows settings. Enable Winlog, choose the file-audit event IDs required by your policy, save the event-ID selection, and then save the group.

Audit file integrity, Winlog, and Files are separate collectors. Select the one that matches your monitoring goal and save the group configuration.

See the Hosts collection guide for the complete controls. If the agent and Winlog are already configured, review the selected event IDs before continuing; installing a second agent is not part of this workflow.

GPO

Use a GPO scoped to the file-server computer accounts, or the approved local policy for a standalone server. Review Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Object Access → Audit File System for a domain GPO.

Enable the success and/or failure auditing required by your monitoring policy. File-system events also require an auditing entry whose principal and access type match the operation; enabling the policy alone is insufficient. See Microsoft’s Audit File System reference.

Apply Policies

If NeQter Support supplies a current NeQter_FS GPO backup, review it and back up existing GPO settings before importing it. Use the supplied backup as the import source, then check that the GPO is linked to the intended OU and filtered to the correct file-server computers. Use the Active Directory setup workflow for scope and policy-verification guidance. A domain-wide link or Enforced setting is not required merely because NeQter collects the events.

Apply the approved computer policy on a test server with gpupdate /target:computer /force, and inspect it with auditpol /get /category:*. These commands update computer policy and display the audit configuration respectively. See Microsoft’s gpupdate and auditpol get references.

Set up folder auditing

On the file server, open the intended folder’s Properties → Security → Advanced → Auditing. Add an auditing entry with the principal, success/failure type, inheritance scope, and operations required by your policy. For a deletion-monitoring example, review Delete and Delete subfolders and files for the intended users and test folder. Microsoft documents applying audit policy to a file or folder.

Start with a test folder. Review existing child-object auditing before changing inheritance or replacing child auditing entries; those controls can affect more than the one folder you opened. Broad principals such as Everyone and broad access selections can produce far more events than a narrowly scoped rule.

Perform an approved test operation on a disposable test file. Confirm its Security event on the server, then find the matching host, time, and event in Discover. This checks both Windows event generation and NeQter collection.

Verify the result

If Windows has no matching event, check the effective audit policy, principal, access selection, and folder inheritance. If the event exists locally but not in NeQter, check Winlog event selection, group membership, agent reporting, and the Discover time range.

After confirming the data, enable the relevant Windows/file-monitoring dashboards in Settings → Dashboards. Enabling a dashboard does not enable Windows auditing or agent collection.

---