Auditing Changes to Shared Folders

Is there a way to use the Windows Security log to audit changes made to shared folders? I can't find any event IDs that notify you when an administrator creates or deletes a shared folder.

You're right; there isn't a specific event ID that notifies you when an administrator creates or deletes a folder, but I worked with Microsoft to come up with a workaround. Because shared-folder definitions are stored in the registry, you can enable auditing on the appropriate registry subkey and then use the Security log's Object Access category to monitor for changes to the shared folder.

Use the Microsoft Management Console-(MMC) Local Security Policy snap-in to enable Audit object access for Success; you'll find the audit policy in Security SettingsLocal PoliciesAudit Policy. Then, run

gpupdate /force 

to force Group Policy to refresh. Next, open Registry Editor (regedit.exe) and go to HKEY_LOCAL_MACHINE SystemCurrentControlSetServices LanmanServerShares. Right-click Shares and select Permissions. Click Advanced, select the Auditing tab, and add an entry that audits Everyone for successful use of Set Value, Create Subkey, Delete, and Write DAC permissions, as Figure 1 shows.

Windows will begin writing sequences of event IDs 560 (Object Open), 567 (Object Access Attempt), and 562 (Handle Closed) to the Security log when someone modifies the Shares subkey in the registry. You'll be notified when someone modifies the shared folders on the system. The only event you need to look for is event ID 560 where Object Name is REGISTRYMACHINESYSTEMControlSet001ServiceslamanserverShares.

Unfortunately, this approach might not provide event information that's as detailed as you'd like. For example, Figure 2 shows the event recorded by Windows when I designated C:junk as a shared folder. As you can see, Windows tells me that the Create Subkey and Set Value permissions were requested for the Shares subkey but gives me no information to help identify the folder. However, seeing such an event will alert you that something related to the shared folders on the system was changed, and you can dig down from there.