How to generate File System Activity Report?

File System Activity Report in NTFS Change Auditor allows you to report the File System changes (created, modified and deleted) made to the folders or files in your servers and workstations, since the application is configured for event data collection. To generate the File System Activity Report, perform the following steps:

  1. Configure object auditing as stated in Configure File System Object Auditing.

  2. Configure the event ID 4663, folder and files for which you want to track the File System changes in Data Collector Settings for security event log data collection. For more information, click How to configure a host for data collection?

  3. To launch 'File System Activity Report' window, click menu in the toolbar. The 'Report Criteria' window will appear as shown below:


  5. Specify the Date range for which you want to generate the reports for.

  6. Select the desired Host Name and Folder/File Name to generate the reports for.

  7. Click Generate button to generate the report.

  8. Once the data collection is complete, the report will be generated in a report window as shown below: