Is there a log for sessions in shared folders in Windows 10?

Question

In Windows and in particular Windows 10 you can easily share or stop sharing a folder or a drive.

I want to see if and who has accessed a drive in a PC. However the only thing I could find was a list of the active sessions on shared folders.

In particular Computer management has an interface that displays all the connected users to shared folders. But this list only provides information about the currently active sessions.

The UI is: Computer Management->System Tools->Shared Folder->Sessions

Do windows 10 have a log that can display past the Sessions on shared folders? If yes where it is?

Solution

In Windows 10, no logging by default is enabled to files and folders. However logging can be enabled, using windows auditing.

In order to enable the auditing in a folder or file there are 2 steps needed.

1. Enable the auditing of object events from the Local Security Policy. To access the Local Security Policy menu, just type "Local Security Policy" in the windows search menu and select it. Go to Security Settings>Local Policies>Audit Object Access. Right click the Audit Object Access item and select properties. Then tick both "failure" and "success" boxes.

2. Apply the enabled auditing events in the folder or file you want to log. Right click the folder/file you want to audit, right click it, select "Properties", go to security tab and click the "Advanced" button and go to the "Auditing" tab in the new pop up window. Then you need to select a principal, and type the name of the user or group that needs to be audited for instance "Authenticated Users", click the "Check Names" to see if the name typed is OK and finally click OK.

After that the logs can be found in Event Viewer. To access the Event Viewer, just type "Event Viewer" in the windows search box and select it. The logs can be found under security logs.

This windows help page is also relevant.