By default, NTFS Change Auditor uses the currently logged on user context to connect to a domain/server. If the currently logged on user does not have sufficient permissions, it uses the alternate domain credential (having domain administrator privileges) for managing all computers in each domain specified in the Domain Credentials Configuration Settings. In this case, NTFS Change Auditor establishes a session with the destination domain/server, using the specified user credential.
NTFS Change Auditor requires the currently logged on user or the provided user credential to be member of local administrators group in the configured hosts to read event logs and report NTFS changes.
After enabling the SACL auditing as mentioned in question 3, you can track the permissions changes by configuring the event ID 4670, folder or file for which you want to track changes in Data Collector Settings.
After enabling the SACL auditing as mentioned in question 3, you can track ownership changes by configuring the event ID 4670, folder or file for which you want to track changes in Data Collector Settings.
After enabling the SACL auditing as mentioned in question 3, you can monitor read/write/delete actions by configuring the event IDs 4663, 5140 and folder, file or a share for which you want to track changes in Data Collector Settings.
You can keep that data as long as it is required. NTFS Change Auditor stores several years of change data in database for security, compliance and regulation purposes. You may also clean up some of the history using the Cleanup tool.
Event flooding may cause some events to get missed out from storing in the application database. This will result in some loss of change data for folders or files while generating the reports. Event flooding may happen due to sudden significant changes across folders and files that are configured for change tracking with SACL auditing settings enabled.
Yes, you can configure event IDs only for Security event log data collection. The application allows you to do this by optionally allowing you to Send E-mail in 'Event Configuration - Add Event Information' dialog.
This may be due to Windows Firewall setting that disallows reading of event log data from servers and workstations. Ensure that the remote event log read is allowed by the Windows Firewall in target servers and workstations by performing the following steps:
Enable the SACL auditing as mentioned in question 3. You can monitor who has accessed the critical folders and files by doing the following actions:
Warning: Enable SACL Auditing for Read attributes only for the critical folders and files. Otherwise auditing this event on a large number of folders, say, on your root folder or other unwanted folders, may cause Event flooding.