Procmon or File System Auditing
Using Procmon, you want to set filters for the following:
- Operation: filter for
SetSecurityFile(use the “is” condition). This will show you any event in which an ACL is modified on a file or directory.
- Path: Set this to the path to your temp folder. If your path is
c:\path\to\temp, enter that. Again use the “is” condition, however you can use the “begins with” condition if you want to see ACL changes to sub folders.
If this needs to be long-running, you most likely want to enable the “Drop Filtered Events” option on the Tools menu.
The benefits of using Procmon are that it is simple to download and run with little preconfiguration at the expense of needing to keep it running at all times.
File System Auditing
To use auditing, you’ll need to do the following:
- In the local policy (or applicable GPO) of the computer, enable Success audits via one of the following:
Computer Configuration | Policies | Windows Settings | Security Settings | Local Policies | Audit Policy | Audit Object Access
Computer Configuration | Policies | Windows Settings | Security Settings | Advanced Audit Policy Configuration | Audit Policies | Object Access | Audit File System
- Enable auditing on your directory by right-clicking on the directory in Windows Explorer and selecting
Properties | Security | Advanced | Auditing | Edit... | Add.... Next, enter
Everyoneas the security principal to audit. Last, check the “Successful” box for “Change permissions”.
- In the Security event log, look for event 4663 or 4670.