Waxaa jira sifo yar oo wanaagsan oo lagu dhex dhisay Windows taas oo kuu ogolaanaysa inaad la socoto marka qof arko, wax ka beddelo, ama tirtiro wax ku jira gal cayiman. Markaa haddii uu jiro gal ama fayl aad rabto inaad ogaato cidda gelaysa, markaa kani waa habka la dhisay adiga oo aan isticmaalin software-ka dhinac saddexaad.

Habkani dhab ahaantii waa qayb ka mid ah habka amniga Windows ee loo yaqaan ^(Windows)Siyaasadda Kooxda^{( Group Policy)} , kaas oo ay isticmaalaan inta badan Xirfadlayaasha IT-ga^{(IT Professionals)} kuwaas oo maamula kombiyuutarada shabakada shirkadaha iyada oo loo marayo server-yada, si kastaba ha ahaatee, waxaa sidoo kale loo isticmaali karaa gudaha PC iyada oo aan lahayn wax server ah. Dhibka kaliya ee ku jira adeegsiga Siyaasadda Kooxda^{(Group Policy)} ayaa ah inaan laga heli karin noocyada hoose ee Windows . Windows 7 , waxaad u baahan tahay inaad haysato Windows 7 Professional ama ka sareeya. Windows 8 , waxaad u baahan tahay Pro ama Enterprise .

Erayga Siyaasadda Kooxda^{(Group Policy)} asal ahaan waxa ay tilmaamaysaa jaangooyooyin diwaangelineed oo lagu xakamayn karo iyada oo loo marayo is-dhexgal isticmaale garaaf ah. Waxaad awood u yeelataa ama damisaa dejinta kala duwan oo tafatirradan ayaa markaa lagu cusboonaysiiyaa diiwaanka Windows .

Gudaha Windows XP , si aad u hesho tifaftiraha siyaasadda, dhagsii Start ka dibna Run . Sanduuqa qoraalka, ku qor " gpedit.msc " iyada oo aan la helin xigashooyinka sida hoos ku cad:

Gudaha Windows 7 , kaliya waxaad riixi kartaa batoonka Start oo ku qor ^(Start)gpedit.msc sanduuqa raadinta ee hoose ee Menu Start^{(Start Menu)} . Gudaha Windows 8 , si fudud u tag shaashadda^{(Start Screen)} bilawga oo billow garaac ama u guuri cursorkaaga dhinaca sare ee midigta ama midigta ee shaashadda si aad u furto Bar Charms oo guji ^(Charms)Search . Kadibna ku qor gpedit . Hadda waa inaad aragto wax la mid ah sawirka hoose:

Waxaa jira laba qaybood oo waaweyn oo siyaasado ah: Isticmaalaha^(User) iyo kumbuyuutarka^(Computer) . Sida aad qiyaasi lahayd, siyaasadaha adeegsaduhu waxay xukumaan jaangooyooyinka isticmaale kasta halka dejinta kombuyuutarku ay noqon doonaan goobo ballaadhan oo ay saamayn doonaan dhammaan isticmaaleyaasha. Xaaladeena waxaan dooneynaa in goobtayadu noqoto mid loogu talagalay dhammaan isticmaalayaasha, markaa waxaan ballaarin doonaa qaybta Isku-habaynta Kombiyuutarka^{(Computer Configuration)} .

Sii wad ku fidinta Windows Settings ->  Security Settings -> Local Policies -> Audit Policy . Ma doonayo inaan ku sharaxo in badan oo ka mid ah goobaha kale ee halkan maadaama tani ay ugu horrayn diiradda saarayso xisaabinta galka. Hadda waxaad arki doontaa siyaasad dejineed iyo habayntooda hadda ee dhinaca midigta. Siyaasadda hanti-dhawrku waa waxa xukuma in nidaamka qalliinka la habeeyey iyo in kale oo diyaar u ah inuu la socdo isbeddellada.

Hadda hubi goobta gelitaanka shayga Hanti^{(Audit Object Access )} -dhawrka adiga oo laba jeer gujinaya oo dooranaya labadaba guusha^(Success) iyo guul^(Failure) -darrada . Guji OK^{(Click OK)} oo hadda waxaan dhameynay qeybtii ugu horreysay oo u sheegaysa Windows inaan rabno inay diyaar u tahay inay la socdaan isbeddellada. Hadda tillaabada xigta waa in aan u sheegno waxa aan rabno^(EXACTLY) in aan raacno. Waxaad hadda xidhi kartaa ka bixida Siyaasadda Kooxda^{(Group Policy)} .

Hadda u gudub faylka adoo isticmaalaya Windows Explorer oo aad jeclaan lahayd inaad la socoto. Gudaha Explorer , midigta guji galka oo guji Properties . Guji tab Amniga^{( Security Tab)} oo aad aragto wax la mid ah kan:

Hadda dhagsii badhanka Advanced oo dhagsii tab Auditing . Tani waa meesha aan dhab ahaantii ku habeyn doono waxa aan rabno inaan kula soconno galkan.

Horey u soco oo dhagsii badhanka Add Waxa soo bixi doona wada hadal kaa codsanaya inaad doorato isticmaale^(User) ama koox^(Group) . Sanduuqa, ku qor ereyga " isticmaalayaasha^(users) " oo dhagsii Magaca Magacyada^{(Check Names)} . Sanduuqa ayaa si otomaatig ah ula cusboonaysiin doona magaca kooxda isticmaalayaasha maxalliga ah ee kombuyuutarkaaga oo ah foomka COMPUTERNAME\Users .

Guji OK^{(Click OK)} oo hadda waxaad heli doontaa wada hadal kale oo loo yaqaan " Audit Entry for X ". Kani waa hilibka dhabta ah ee waxa aanu rabnay inaanu samayno. Halkan waa meesha aad ka dooran doonto waxaad rabto inaad ku daawato galkan. Waxaad si gaar ah u dooran kartaa noocyada hawlaha aad rabto in aad la socoto, sida tirtirka ama abuurista faylasha / faylalka cusub, iwm^{(Full Control)} . Taas u samee si aad u guuleysato iyo guul ^(Success)darrida^(Failure) . Sidan, wax kasta oo lagu sameeyo galkaas ama faylasha ku jira, waxaad yeelan doontaa rikoodh.

Hadda dhagsii OK oo taabo OK mar kale oo OK hal mar oo kale si aad uga baxdo sanduuqa wada hadalka ee badan. Oo hadda waxaad si guul leh u habaysay xisaabinta galka! Markaa waxaad waydiin kartaa, sidee u aragtaa dhacdooyinka?

Si aad u aragto dhacdooyinka, waxaad u baahan tahay inaad tagto Control Panel oo guji Qalabka Maamulka^{(Administrative Tools)} . Markaa fur Daawaha Dhacdada^{(Event Viewer)} . Guji qaybta Amniga^(Security) oo waxaad arki doontaa liiska dhacdooyinka ee dhinaca midig:

Haddii aad horay u sii waddo oo aad sameyso fayl ama aad si fudud u furto galka oo guji batoonka Cusbooneysii ee ku yaala ^(Refresh)Muuqaalka Dhacdada^{(Event Viewer)} (badhanka leh labada fallaadho ee cagaarka ah), waxaad arki doontaa farabadan dhacdooyinka qaybta Nidaamka Faylka^{( File System)} . Kuwani waxay khuseeyaan tirtirid kasta, abuur, akhri, qor hawlgallada faylalka/faylalka aad xisaabinayso. Gudaha Windows 7 , wax kastaa hadda waxay ka soo baxayaan qaybta hawsha File System , si aad u aragto waxa dhacay, waa inaad mid walba gujisaa oo dhex rogtaa.

Si aad u sahlanaato in la eego dhacdooyin badan, waxaad dhejin kartaa filter oo kaliya waxaad arki kartaa waxyaabaha muhiimka ah. Guji^(Click) liiska View ee sare oo guji Filter . Haddii aysan jirin ikhtiyaarka Shaandheynta^(Filter) , ka dib midig-guji galka Amniga^(Security) ee bogga bidix oo dooro Filter Log hadda^{(Filter Current Log)} . Sanduuqa aqoonsiga dhacdada^{(Event ID)} , ku qor lambarka 4656 . Tani waa dhacdada la xiriirta isticmaale gaar ah oo fulinaya ficil Nidaamka Faylka ^{(File System )} waxayna ku siin doontaa macluumaadka la xiriira adiga oo aan fiirin kumanaan galmood.

Haddii aad rabto inaad hesho macluumaad dheeraad ah oo ku saabsan dhacdo, si fudud laba jeer guji si aad u aragto.

Tani waa macluumaadka laga helay shaashadda sare:

Qabashada shay ayaa la codsaday.^{(A handle to an object was requested.)}

Mawduuca: ^(Subject:)
Security ID: Aseem-Lenovo\Aseem
Magaca Koontada: Aseem ^{( Account Name: Aseem)}
Domain Account: Aseem-Lenovo ^{( Account Domain: Aseem-Lenovo)}
Aqoonsiga Logon: 0x175a1^{( Logon ID: 0x175a1)}

Shayga: ^(Object:)
Adeegaha Shayga: ^{( Object Server: Security)}
Nooca Nabadgelyada Walaxda: Magaca faylka ^{( Object Type: File)}
Object Name: C:\Users\Aseem\Desktop\Tufu\New Text Document.txt
Aqoonsiga Gacanta: 0x16a0^{( Handle ID: 0x16a0)}

Macluumaadka ^{(Process Information:)}
Habka: Aqoonsiga Habka: 0x820 ^{( Process ID: 0x820)}
Process Name: C:\Windows\explorer.exe

Helitaanka Macluumaadka Codsiga: ^{(Access Request Information:)}
Aqoonsiga Ganacsiga: {00000000-0000-0000-0000-00000000000} ^{( Transaction ID: {00000000-0000-0000-0000-000000000000})}
Gelitaanka: ^{( Accesses: DELETE)}
Tirtir SYNCHRONIZE Tilmaamaha ^{( SYNCHRONIZE)}
Akhriska^{( ReadAttributes)}

Tusaalaha kore, faylka lagu shaqeeyay wuxuu ahaa Dukumeenti Qoraal^{(New Text Document.txt)} ah oo Cusub.txt oo ku jira galka Tufu ee miiskayga iyo marinnada aan codsaday waxa ay ahaayeen DELETE oo ay ku xigto SYNCHRONIZE . Waxa aan halkan ku sameeyay waa tirtiray faylka. Waa kan tusaale kale:

Nooca Shayga: ^{( Object Type: File)}
Object Name: C:\Users\Aseem\Desktop\Tufu\Address Labels.docx
Aqoonsiga Gacanta: 0x178^{( Handle ID: 0x178)}

Macluumaadka ^{(Process Information:)}
Habka: Aqoonsiga Habka: 0x1008 ^{( Process ID: 0x1008)}
Process Name: C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

Macluumaadka Codsiga Helitaanka: ^{(Access Request Information:)}Aqoonsiga ^{( WriteAttributes)}Ganacsiga ^{( ReadAttributes)}
: { ^{( Transaction ID: {00000000-0000-0000-0000-000000000000})}00000000-0000-0000-0000-00000000000 ^{( WriteEA)}} ^{( AppendData (or AddSubdirectory or CreatePipeInstance))}Gelitaanka ^{( ReadEA)}
: ^{( Accesses: READ_CONTROL)}READ_CONTROL ^{( WriteData (or AddFile))}
SYNCHRONIZE
ReadData^{( ReadData (or ListDirectory))}

Sababaha gelitaanka: READ_CONTROL: Waxaa bixiyay lahaanshaha ^{( Access Reasons: READ_CONTROL: Granted by Ownership)}
SYNCHRONIZE: Waxaa bixiyay D:(A;ID;FA;;;S-1-5-21-597862309-2018615179-2090787082-1000)^{( SYNCHRONIZE: Granted by D:(A;ID;FA;;;S-1-5-21-597862309-2018615179-2090787082-1000))}

Markaad akhrido tan, waxaad arki kartaa inaan galay Cinwaanka Labels.docx anigoo^{(Address Labels.docx)} isticmaalaya barnaamijka WINWORD.EXE iyo gelitaankeyga waxaa ka mid ahaa READ_CONTROL ^{(WINWORD.EXE)}iyo^{(READ_CONTROL)} sababaha gelitaankayga sidoo kale READ_CONTROL . Caadi ahaan, waxaad arki doontaa farabadan gelisyo badan, laakiin kaliya diiradda saar kan ugu horreeya maadaama taasi badanaa tahay nooca ugu muhiimsan ee gelitaanka. Xaaladdan oo kale, waxaan si fudud u furay faylka anigoo isticmaalaya Word . Waxay qaadanaysaa tijaabo yar iyo akhrinta dhacdooyinka si loo fahmo waxa socda, laakiin markaad hoos u dhigto, waa nidaam la isku halayn karo. Waxaan soo jeedinayaa in la abuuro gal imtixaan leh faylal iyo samaynta ficillo kala duwan si loo arko waxa ka muuqda Muuqaalka Dhacdada^{(Event Viewer)} .

Taasi waa wax aad u qurux badan! Hab degdeg ah oo xor ah oo lagula socdo gelitaanka ama beddelka galka!

How to Track When Someone Accesses a Folder on Your Computer

There’s a nice littlе featυre built into Wіndows that allows you to track when someone νiews, edits, or deleteѕ something inside of a specified folder. So if there’s a folder or file that you want to know who is accessing, then this is the built-in method without havіng to use third-party softwarе.

This feature is actually part of a Windows security feature called Group Policy, which is used by most IT Professionals who manage computers in the corporate network via servers, however, it can also be used locally on a PC without any servers. The only downside to using Group Policy is that it is not available in lower versions of Windows. For Windows 7, you need to have Windows 7 Professional or higher. For Windows 8, you need Pro or Enterprise.

The term Group Policy basically refers to a set of registry settings that can be controlled via a graphical user interface. You enable or disable various settings and these edits are then updated in the Windows registry.

In Windows XP, to get to the policy editor, click on Start and then Run. In the text box, type “gpedit.msc” without the quotes as shown below:

In Windows 7, you would just click on the Start button and type gpedit.msc into the search box at the bottom of the Start Menu. In Windows 8, simply go to the Start Screen and start typing or move your mouse cursor to the far top or bottom right of the screen to open the Charms bar and click on Search. Then just type in gpedit. Now you should see something that is similar to the image below:

There are two main categories of policies: User and Computer. As you might have guessed, the user policies control the settings for each user whereas the computer settings will be system wide settings and will effect all users. In our case we’re going to want our setting to be for all users, so we’ll expand the Computer Configuration section.

Continue expanding to Windows Settings -> Security Settings -> Local Policies -> Audit Policy. I’m not going to explain much of the other settings here since this is primarily focused on auditing a folder. Now you’ll see a set of policies and their current settings on the right hand side. Audit policy is what controls whether or not the operating system is configured and ready to track changes.

Now check the setting for Audit Object Access by double clicking on it and selecting both Success and Failure. Click OK and now we’re done the first part which is telling Windows that we want it to be ready to monitor changes. Now the next step is to tell it what EXACTLY we want to track. You can close out of the Group Policy console now.

Now navigate to the folder using Windows Explorer that you would like to monitor. In Explorer, right click on the folder and click Properties. Click on the Security Tab and you see something similar to this:

Now click on the Advanced button and click on the Auditing tab. This is where we’ll actually configure what we want to monitor for this folder.

Go ahead and click the Add button. A dialog will appear asking you to select a User or Group. In the box, type in the word “users” and click Check Names. The box will automatically update with the name of the local users group for your computer in the form COMPUTERNAME\Users.

Click OK and now you’ll get another dialog called “Audit Entry for X“. This is the real meat of what we’ve been wanting to do. Here is where you’ll select what you want to watch for this folder. You can individually choose which types of activity you want to track, such as deleting or creating new files/folders, etc. To make things easier, I suggest selecting Full Control, which will automatically select all the other options below it. Do this for Success and Failure. This way, whatever is done to that folder or the files within it, you will have a record.

Now click OK and click OK again and OK one more time to get out of the multiple dialog box set. And now you have successfully configured auditing on a folder! So you might ask, how do you view the events?

In order to view the events, you need to go to the Control Panel and click on Administrative Tools. Then open up the Event Viewer. Click on the Security section and you’ll see a large listing of events on the right hand side:

If you go ahead and create a file or simply open the folder and click the Refresh button in the Event Viewer (the button with the two green arrows), you’ll see a bunch of events in the category of File System. These pertain to any delete, create, read, write operations on the folders/files you are auditing. In Windows 7, everything now shows up under File System task category, so in order to see what happened, you’ll have to click on each one and scroll through it.

In order to make it easier to look through so many events, you can put a filter and just see the important stuff. Click on the View menu at the top and click on Filter. If there is no option for Filter, then right-click on the Security log in the left-hand page and choose Filter Current Log. In the Event ID box, type in the number 4656. This is the event associated with a particular user performing a File System action and will give you the relevant information without having to look through thousands of entries.

If you want to get more information about an event, simply double click on it to view.

This is the information from the screen above:

A handle to an object was requested.

Subject:
Security ID: Aseem-Lenovo\Aseem
Account Name: Aseem
Account Domain: Aseem-Lenovo
Logon ID: 0x175a1

Object:
Object Server: Security
Object Type: File
Object Name: C:\Users\Aseem\Desktop\Tufu\New Text Document.txt
Handle ID: 0x16a0

Process Information:
Process ID: 0x820
Process Name: C:\Windows\explorer.exe

Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: DELETE
SYNCHRONIZE
ReadAttributes

In the example above, the file worked on was New Text Document.txt in the Tufu folder on my desktop and the accesses that I requested were DELETE followed by SYNCHRONIZE. What I did here was delete the file. Here’s another example:

Object Type: File
Object Name: C:\Users\Aseem\Desktop\Tufu\Address Labels.docx
Handle ID: 0x178

Process Information:
Process ID: 0x1008
Process Name: C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: READ_CONTROL
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
ReadEA
WriteEA
ReadAttributes
WriteAttributes

Access Reasons: READ_CONTROL: Granted by Ownership
SYNCHRONIZE: Granted by D:(A;ID;FA;;;S-1-5-21-597862309-2018615179-2090787082-1000)

As you read through this, you can see I accessed Address Labels.docx using the WINWORD.EXE program and my accesses included READ_CONTROL and my access reasons were also READ_CONTROL. Usually, you’ll see a bunch more accesses, but just focus on the first one as that’s usually the main type of access. In this case, I simply opened the file using Word. It does take a little testing and reading through the events to understand what’s going on, but once you have it down, it’s a very reliable system. I suggest creating a test folder with files and performing various actions to see what shows up in the Event Viewer.

That’s pretty much it! A quick and free way to track access or changes to a folder!

Related posts

• Sida Loo Sameeyo Fayl Sugan oo Xidhan gudaha Windows XP

• Sida loo kaydiyo Layout-ka desktop-kaaga gudaha Windows XP, 7, 8

• Sida loo hagaajiyo "NtFS.sys maqan ama kharriban" Khaladka Windows XP

• Meel fog laga galo Windows XP ama Windows Server 2003 Computer

• Ku rakib Printer Network ka Windows XP Adigoo isticmaalaya Dejinta Darawalka

• Fix Diiwaangelinta Tafatirka waxaa curyaamiyay qaladka maamulahaaga

• Sida Loo Hubiyo Dejinta Adeegga Proxy-ka ee Kumbuyuutarkaaga

• Sida Loo Helo Ogeysiinta Aaladdaga Android Kombayutarkaga

• Waa maxay galka PerfLogs ee Windows 10

• Ku biir Kumbuyuutar Windows XP ah Windows 7/8/10 Kooxda Guriga

• Cilad-samaynta Dhibaatooyinka Isku-xidhka Shabakadda Wireless-ka ee Windows XP

• Ku dheji faylka VHD ee Windows XP

• Demi ama saar "Kombuyuutarkaaga waxaa laga yaabaa inuu khatar ku jiro" Windows XP

• Software bilaash ah si aad u tirtirto galka madhan ee Windows 11/10

• Ku dheji Fayl kasta oo Windows ah Google Drive, OneDrive iyo Dropbox

• Ku habee ama dami DEP (Kahortagga Fulinta Xogta) gudaha Daaqadaha

• Ku socodsii Ciyaarihii hore ee DOS iyo Barnaamijyada Windows XP, Vista, 7/8/10

• Sida loo dejiyo Desktop Remote on Windows XP

• Sida loogu daro Barnaamij lagu bilaabo Windows XP

• msvcr120.dll Ma Ka maqan yahay Kumbiyuutarkaaga? 8 Siyaabaha loo Hagaajin karo