Skip to main content

Why Am I Receiving FileAccessed Events in Change Tracker?

Overview​

This article describes why you are receiving File Access events in Netwrix Change Tracker, what they are, and how to disable or enable them.

The fileaccessed event is a read operation for the file shown in the details. This does not mean someone changed the file — it simply means the file was accessed (or read), whether by a person or software. Think of it as someone opening a Word document. If you were tracking that, you would see the same notification for the Word document simply being opened.

How to Enable or Disable FileAccessed Events​

These events are controlled from a Policy Template applied to a device group — devices in the group inherit the template's settings.

NOTE: When you update a policy template, the agent does a re-baseline of the files within the defined parameters. Changes to the files are not visible until after the baseline is completed. A baseline typically takes about 15-20 minutes to complete on a Windows device. If you are testing a change to this folder, wait about 30 minutes after saving the template so the agent has time to complete its baseline process.

Disabling File Access Events​

To disable file access events:

  1. Go to the Settings Tile > Click on the Policy Templates Navigation button to the left.
  2. Find the Policy Template that you want to use for these event types, or create a new one by pressing the Create a Template button.
  3. Click the Edit button on the template you want to modify.
  4. For the desired path, locate the Tracked Attributes column. Click the Edit button and change this to File Attributes – Excluding contents only.
  5. Click Save Changes at the top of the page.
  6. If this is a new template, apply it to the group of devices by going to Settings > Device Groups > Select the group > Policy Templates > Add a template.

Enabling File Access Events​

To enable file access events:

  1. Go to the Settings Tile > Click on the Policy Templates Navigation button to the left.
  2. Find the Policy Template that you want to use for these event types, or create a new one by pressing the Create a Template button.
  3. Click the Edit button on the template you want to modify.
  4. For the desired path, locate the Tracked Attributes column. Click the Edit button and change this to All file and folder attributes excluding contents.
  5. Click Save Changes at the top of the page.
  6. If this is a new template, apply it to the group of devices by going to Settings > Device Groups > Select the group > Policy Templates > Add a template.