Audit file system global object access This policy setting allows you to apply a comprehensive object access audit policy ...

Audit file system global object access

This policy setting allows you to apply a comprehensive object access audit policy to every file and folder on the file system for a computer. Configuring this setting also allows you to demonstrate that every file and folder on the computer is monitored by an audit policy that is managed from a central location.

This setting applies a global system access control list (SACL) to every file and folder. If both a file or folder SACL and a global SACL are configured on a computer, the effective SACL is derived by combining the file or folder SACL and the global SACL. This means that an audit event is generated when an activity matches either the file or folder SACL or the global SACL.

To configure a global object access policy, you must select Define this policy setting and click Configure to add at least one user or group to the global SACL. You must also enable the Audit File System setting under Advanced Audit Policy Configuration\System Audit Policies\Object Access.

Volume: Depends on the effective SACL and the level of user activity.