# Monitor administrator in network folders

**URL:** <https://discuss.elastic.co/t/monitor-administrator-in-network-folders/121830>\
**Category:** Beats\
**Created:** [February 28, 2018, 10:41am UTC](https://discuss.elastic.co/t/monitor-administrator-in-network-folders/121830 "2018-02-28T10:41:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [February 28, 2018, 10:41am UTC](https://discuss.elastic.co/t/monitor-administrator-in-network-folders/121830/1 "2018-02-28T10:41:12Z")

</div>

Hi All,

I have query on this .  
Do we have any beats or something to monitor administrator access to specific network folders?

We have a variety of classic network drives, one of which must be monitored.

Need: If an administrator edits permissions on the folder, or reads / edits files in the folder, an email must be sent to person ABC.

The solution must in some way be protected from being disabled by a domain admin, via a different code or similar.

Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 2, 2018, 2:02am UTC](https://discuss.elastic.co/t/monitor-administrator-in-network-folders/121830/2 "2018-03-02T02:02:31Z")

</div>

I wonder if this is something auditbeat could do (@andrewkroh)?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 4, 2018, 9:11pm UTC](https://discuss.elastic.co/t/monitor-administrator-in-network-folders/121830/3 "2018-03-04T21:11:44Z")

</div>

I think this could be done by using the built-in Windows auditing features. You can enable auditing for a particular actions on certain resources and then Windows will write an audit event to the event log. Then you can use Winlogbeat to read those events.

The email could be sent by the [Alerting feature](https://www.elastic.co/products/x-pack/alerting) in X-Pack.

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [March 4, 2018, 10:10pm UTC](https://discuss.elastic.co/t/monitor-administrator-in-network-folders/121830/4 "2018-03-04T22:10:47Z")

</div>

Thank you guys 😄

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2018, 12:11am UTC](https://discuss.elastic.co/t/monitor-administrator-in-network-folders/121830/5 "2018-04-02T00:11:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.