> For the complete documentation index, see [llms.txt](https://docs.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blusapphire.io/log-forwarding/03_log-forwarding-guide/log-forward/microsoft/windows-fim/fim-integration-with-gpo.md).

# FIM Integration with GPO

### Enable Windows File System Auditing

#### Step 1: Enable Audit Policy

First, go to the Domain Controller (DC) and update the Group Policy (GPO) to enable file auditing.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FwgwoBuRRVey4ZGWhIJhR%2F282d019f%20357e%204f9a%209a63%20418441355880.png?alt=media)

Right click on the Group Policy you want to update or create a new [GPO](https://www.varonis.com/blog/group-policy/?hsLang=en) for file auditing. In the right-click menu, select edit to go to the [Group Policy Editor](https://www.varonis.com/blog/group-policy-editor/?hsLang=en).

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FgejzD0CGikrOEF03HqeS%2F98a7acec%207fec%204b24%20ae75%20de7ed01e6b96.png?alt=media)

*\*Here, created a new GPO called “File Auditing” for the purposes of this example.*

In the Group Policy editor, click through to *Computer Configuration -> Policies ->* *Windows Settings -> Local Policies.* Click on *Audit Policy.*

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2Fdm6xgxPhJd5zYXGsxrCI%2F9cfe487d%209ccb%204e3e%2095c1%20fb981e616589.png?alt=media)

Double-click “Audit object access” and set it to both success and failure.

To enable your new GPO, go to a command line and run ‘gpupdate /force’.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FKpdzqmGQao8ZzZPR7M9Q%2F83048407%207b2c%204942%20ae7c%20804d38db1cb9.png?alt=media)

Verify that your policy is set correctly with the command ‘gpresult /r’ on the computer that you want to audit.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2F34aK0sO0UiWVipOOKBrj%2Ff5ec95f4%20e75c%204a66%20b1c8%20f963ed062c37.png?alt=media)

#### Step 2: Apply Audit Policy to Files and/or Folders.

Next, tell Windows exactly which files and/or folders that you want to audit. Here is the procedure to set auditing up for your folders.

* Right-click the file or folder in Windows Explorer. Select *Properties*.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FkdRtGM8orPtnfjbbG4wm%2Fd4bfea29%20c27c%20475a%20b9d5%200e54569036b2.png?alt=media)

* Change to the Security tab and click Advanced.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FclEGrUIV5SDd1bQzU6uI%2F411de98f%207965%204928%208723%207bc3ad1fccd0.png?alt=media)

* Click the Auditing tab and then Continue.
* Add the Users or Groups that you want to audit and check all of the appropriate boxes.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2F62Jhx3zT1qYUSGd1rSJU%2F788cb63b%208ff1%20418c%20b3c4%20074a70f72f40.png?alt=media)

#### Step 3: Open Event Viewer

Once you have enabled the Auditing GPO and set the file/folder auditing, you will see audit events in the Security Event Log in Windows Event Viewer.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FgUKiR8iI5NrPCDv8xU49%2F399d13e0%20919c%204502%20aaaa%20e4afc0adefc1.png?alt=media)