> For the complete documentation index, see [llms.txt](https://docs.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blusapphire.io/log-forwarding/03_log-forwarding-guide/log-forward/microsoft/windows-fim/fim-integration-with-gpo.md).

# FIM Integration with GPO

### Enable Windows File System Auditing

#### Step 1: Enable Audit Policy

First, go to the Domain Controller (DC) and update the Group Policy (GPO) to enable file auditing.

![](/files/cdIwig0wGxT39DxBpGTb)

Right click on the Group Policy you want to update or create a new [GPO](https://www.varonis.com/blog/group-policy/?hsLang=en) for file auditing. In the right-click menu, select edit to go to the [Group Policy Editor](https://www.varonis.com/blog/group-policy-editor/?hsLang=en).

![](/files/P1hr7dIMvN7ibPRJXSaL)

*\*Here, created a new GPO called “File Auditing” for the purposes of this example.*

In the Group Policy editor, click through to *Computer Configuration -> Policies ->* *Windows Settings -> Local Policies.* Click on *Audit Policy.*

![](/files/JOIMZv5GrMrfdJ4YuyBC)

Double-click “Audit object access” and set it to both success and failure.

To enable your new GPO, go to a command line and run ‘gpupdate /force’.

![](/files/EBk2M19wS7ncOlXJZViU)

Verify that your policy is set correctly with the command ‘gpresult /r’ on the computer that you want to audit.

![](/files/weuSDMQPf17F5TEDoCua)

#### Step 2: Apply Audit Policy to Files and/or Folders.

Next, tell Windows exactly which files and/or folders that you want to audit. Here is the procedure to set auditing up for your folders.

* Right-click the file or folder in Windows Explorer. Select *Properties*.

![](/files/fsO60O30EGuJT4TVNVHE)

* Change to the Security tab and click Advanced.

![](/files/5u0piUlChfNNhjJfYyqD)

* Click the Auditing tab and then Continue.
* Add the Users or Groups that you want to audit and check all of the appropriate boxes.

![](/files/eJKe5BhXDUkwevr88icu)

#### Step 3: Open Event Viewer

Once you have enabled the Auditing GPO and set the file/folder auditing, you will see audit events in the Security Event Log in Windows Event Viewer.

![](/files/BhWMz7LbtMFxOxV4E8i2)