How to Configure Advanced Audit Policy Configuration using Windows Group Policy

The Need for Granular Auditing

By default, Windows Server auditing is relatively simplistic. The legacy audit policies found in standard Group Policy only offer nine broad categories (such as “Audit Logon Events” or “Audit Object Access”). If you enable legacy “Audit Object Access,” your Event Viewer will be immediately flooded with millions of logs recording every single file interaction on the server, making it impossible to find the specific event you are actually looking for.

To solve this, Microsoft introduced Advanced Audit Policy Configuration. Instead of nine broad categories, the Advanced Audit Policy breaks auditing down into over 50 highly specific subcategories. This allows you to audit “File Share” access without simultaneously auditing the core “File System,” drastically reducing log noise and preserving CPU performance.

Step 1: Disable Legacy Auditing

Before you implement Advanced Audit Policies, you must explicitly tell Windows to ignore the legacy policies, otherwise they will conflict and cause unpredictable logging behavior.

1. Open the Group Policy Management Console (gpmc.msc).
2. Create a new GPO (e.g., “Advanced Auditing Baseline”) and link it to your Domain Controllers OU or the specific server OU you want to monitor.
3. Right-click the new GPO and select Edit.
4. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
5. Find the policy named: Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings.
6. Double-click it, set it to Enabled, and click OK.

Step 2: Configure the Advanced Audit Policies

Now you can enable the granular subcategories.

1. In the same Group Policy Editor window, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies.
2. You will see several categories. Expand Object Access.
3. Instead of a single blanket policy, you will see specific subcategories like Audit File Share, Audit Registry, and Audit SAM.
4. Double-click Audit File Share. Check the box to configure the events, and select both Success and Failure. Click OK.

You can repeat this process for other critical subcategories, such as enabling Audit User Account Management (under the Account Management category) to track exactly who is creating or deleting Active Directory users.

Step 3: Force the Group Policy Update

For the new advanced auditing settings to take effect, the target servers must refresh their Group Policy.

Log into the target server, open an elevated Command Prompt or PowerShell window, and run:

gpupdate /force

Step 4: Verify the New Logs

Once the policy is applied, you can verify that the advanced granular auditing is working.

1. Open the Event Viewer (eventvwr.msc) on the target server.
2. Navigate to Windows Logs > Security.
3. Filter the current log for Event ID 5140 (A network share object was accessed).

You will now see clean, specific logs detailing exactly who accessed your network shares, without the millions of useless file-system read/write logs that the legacy policy would have generated.