Access types
Windows access types
Here is the list of access types Audited by FileAudit for Windows file servers.
| Windows access types | |
| Delete | A user tried to delete a file/folder. |
| Ownership | A user tried to take ownership on the file/folder |
| Permissions | A user tried to change the permissions on the file/folder. |
| Write | A user tried to modify a file. |
| Execute | A user tried to execute an executable file. |
| Read | A user tried to open a file in ‘Read’ mode. |
| System | An attempt to read or write the System Access Control List (SACL), i.e. the audit entries of the file/folder. (Pre-Vista only). |
| Write attributes | A user tried to modify a file attribute (like Read-only or Hidden checkboxes). |
| Rename | A user tried to rename a file (available if using Vista/Windows Server 2008 onwards). |
| Move | A user attempted to move a file / folder (available if using Vista/Windows Server 2008 onwards). |
| Other | Composite events, where an event can be a combination of several access events - e.g. Write and read or Delete and read, etc. (Windows 2003 Server only) |
Take note that an event is generated for an attempted access. If a user without enough privileges attempts to delete a file on a monitored folder, you will be alerted of a ‘Delete’ event with a status ‘Denied’.
Cloud access types
Here is the list of access types audited for Cloud file storages.
| Box | Dropbox | Google Drive | OneDrive | |
| Read | check_circle 1 | check_circle 1 | check_circle 1 | check_circle 2 |
| Write | check_circle | check_circle | check_circle | check_circle |
| Delete | check_circle | check_circle | check_circle | check_circle |
| Move | check_circle | check_circle 1 | check_circle | check_circle |
| Copy | check_circle 1 | check_circle 1 | check_circle 1 | check_circle 1 |
| Create | check_circle | check_circle | check_circle | check_circle |
| Rename | check_circle | check_circle | check_circle | |
| Download | check_circle | check_circle | check_circle | |
| Shared | check_circle 3 | check_circle | check_circle | |
| Unshared | check_circle 1 | check_circle | ||
| Destroy (from trash) | check_circle 1 | check_circle 1 | check_circle 1 | |
| Restore (from trash) | check_circle 1 | check_circle | check_circle 1 | |
| Revert | check_circle | |||
| Lock | check_circle | |||
| Unlock | check_circle | |||
| Check In 4 | check_circle | |||
| Check Out 5 | check_circle | |||
| Undo Check Out 6 | check_circle |
- 1: From web site only
- 2: From web site or Office 2016 app
- 3: No real-time notification but notified with next event
- 4: A user checked in a file in Sharepoint Online.
- 5: A user tried to checked out a file in Sharepoint Online.
- 6: A user discarded a check out of a file in Sharepoint Online.