What are the steps in enabling auditing for an NTFS folder?

Answer:

To audit files and folders, perform these steps:

1. Open Windows Explorer.
2. Right-click the file or folder that you want to audit, click Properties, and then click the Security tab.
3. Click Edit, and then click Advanced.
4. In the Advanced Security Settings for [object] dialog box, click the Auditing tab.
5. Click the Edit button.
6. Do one of the following:
   • To set up auditing for a new user or group, click Add. In Enter the object name to select, type the name of the user or group that you want, and then click OK.
   • To remove auditing for an existing group or user, click the group or username, click Remove, click OK, and then skip the rest of this procedure.
   • To view or change auditing for an existing group or user, click its name, and then click Edit.
7. In the Apply onto box, click the location where you want auditing to take place.
8. In the Access box, indicate what actions you want to audit by selecting the appropriate check boxes:
   • To audit successful events, select the Successful check box.
   • To stop auditing successful events, clear the Successful check box.
   • To audit unsuccessful events, select the Failed check box.
   • To stop auditing unsuccessful events, clear the Failed check box.
   • To stop auditing all events, click Clear All.
9. If you want to prevent subsequent files and subfolders of the original object from inheriting these audit entries, select the Apply these auditing entries to objects and/ or containers within this container only check box.
10. Click OK to close the Advanced Security Settings dialog box.
11. Click OK to close the Properties dialog box.