Your company's auditors require a trail of every successful or failed attempt to read, create, modify, or delete files inside a sensitive folder on a Windows Server 2022 file server. A system access control list (SACL) has already been applied to the folder that specifies which operations must be audited. Which single Advanced Audit Policy subcategory must be enabled on the server so that the requested events are written to the Security log?
A SACL by itself is not enough-Windows will only write file-level access events when the corresponding Object Access audit setting is turned on. The specific subcategory that records activity against files and folders is Audit File System. It generates events such as 4663 for every read, write, or delete that matches the SACL.
Audit File Share instead logs one event (for example, 5140) when a client connects to a share and does not trace per-file operations. Audit Account Logon records Kerberos or NTLM authentications on a domain controller, and Audit Authorization Policy Change tracks changes to user-rights assignments or privileges-not file access. Therefore, enabling Audit File System is the only option that meets the auditing requirement.