# Monitoring a Windows file Server user info **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [September 12, 2018, 12:40pm UTC](https://discuss.elastic.co/t/monitoring-a-windows-file-server-user-info/148324 "2018-09-12T12:40:25Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![alejandro.perez](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@alejandro.perez](https://discuss.elastic.co/u/alejandro.perez)\ **Post date:** [September 12, 2018, 12:40pm UTC](https://discuss.elastic.co/t/monitoring-a-windows-file-server-user-info/148324/1 "2018-09-12T12:40:25Z")
Hello , if i´m monitoring a Windows file Server, How can I log the user info? Thank you in advance. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 14, 2018, 1:09pm UTC](https://discuss.elastic.co/t/monitoring-a-windows-file-server-user-info/148324/2 "2018-09-14T13:09:05Z")
The file\_integrity module can report changes to files/dirs but not who made the change. This is because the API use to watch for changes does not include the data. Windows has a built-in audit capability that can that you can deploy that reports events to the Security event log. Those events can then be read by Winlogbeat and forwarded to Elasticsearch. See [https://docs.microsoft.com/en-us/windows-server/identity/solution-guides/plan-for-file-access-auditing](https://docs.microsoft.com/en-us/windows-server/identity/solution-guides/plan-for-file-access-auditing). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 5, 2018, 1:09pm UTC](https://discuss.elastic.co/t/monitoring-a-windows-file-server-user-info/148324/3 "2018-10-05T13:09:10Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.