NTFS Change Auditor

Auditing Features to Report about the NTFS Changes

Configuration Wizard

Configure your Domain connections, Database settings and Email notification settings using a Wizard.

Configure settings for Domain connections, Database settings and Email notification

Generate events reports about NTFS changes based on keywords

Change Reports

Share Activity Reports (accessed, created, modified and deleted objects), Permissions Changes, File System Access and Change Reports (accessed (read), created, modified, deleted and ownership changes), Ownership Changes and Who Accessed What report. A powerful free-text search filter allows you to generate the events reports based on keywords. For example, report the Permissions Changes of a particular folder or file in the last 30 days.

Data Collector Settings

Configure Shared Folders, Folders and Files in servers and workstations for fast data collection and storage of change events using asynchronous, multi-threaded data collection from multiple servers and workstations. Real time alerts through email – powered by the multi-tasking background listener (NTFS Listener Service). Enables notifications of change events that occurred in File servers in real time.

Configure Windows for fast data collection about changes in NTFS

View occurrence of all events in NTFS using Data Collector Settings tool

Live Monitor

The Live Monitor tool allows you to view the occurrence of all the events for Event IDs configured in the Data Collector Settings tool as soon as they are captured by the application’s NTFS Listener Service.

Search Change History

The powerful search tool lets you select Event IDs for the selected date range and host names. For example, extract all the ‘4663’ event IDs that occurred in the month of March from the events history database.

Search NTFS change history for the selected date range and host names

Filter change data in NTFS based on search strings and dates

Quick Filter

Quickly filter data based on search strings and dates. Wildcard characters may be applied. For example, all rows of change data pertaining to “Administrators” may be filtered by a simple string filter “*admin*” across all fields or a single field.

Advanced Filter

Advanced Filter tool in the reports allows you to filter the report based on complex filter conditions. Advanced Filter allows the User to perform advanced query based filtering using Field names and their values and save the filter configuration for future use. Selecting and applying a saved filter will apply the filter and directly produce the desired subset of data. For example, all rows of Share accessed data pertaining to ‘Change made by’ field can be filtered by compound filter (([Change made by] ends with ‘%Martin %’) or ([Change made by] = ‘Contoso\Williams’)).

Filter NTFS reports based on complex & advanced filter conditions

Highlights all cells containing occurrences of the string in report


A simple string-based Find operation highlights all cells containing the string. Especially useful in determining string occurrences and their frequencies in a large set of displayed data. For example, find all occurrences of a particular file.


Flexible Export feature to export the Change reports to HTML/ CSV /XLSX file formats instantly.

Export NTFS Change reports as HTML/ CSV /XLSX file

Get Instant Email notification about NTFS Changes

Instant Email notification

Instantly notify changes to different Shares, Folders and Files as soon as changes are detected.