How to Detect Who Changed a File or Folder Owner

Native Auditing

Netwrix Auditor for Windows File Servers

Steps

Navigate to the required file share → Right-click it and select "Properties" → Switch to the "Security" tab → Click the "Advanced" button → Go to the "Auditing" tab → Click the "Add" button → Select Principal: "Everyone"; Select Type: "All"; Select Applies to: "This folder, subfolders and files"; Select the following "Advanced Permissions": "Change permissions and "Take ownership".
Run gpmc.msc → Edit "Default Domain Policy" → Computer Configuration → Policies → Windows Settings → Security Settings.
Go to Local Policies → Audit Policy:
- Audit object access → Define → Success and Failures
Go to "Advanced Audit Policy Configuration" → Audit Policies → Object Access:
- Audit File System → Define → Success and Failures
- Audit Handle Manipulation → Define → Success and Failures
Go to Event Log → Define:
- Maximum security log size to 1 GB
- Retention method for security log to “Overwrite events as needed”
Open Event Viewer → Search the Security Windows Logs for the event ID 4663 with the "File Server" or "Removable Storage" task category and with the "Accesses: WRITE_OWNER" string. "Subject Security ID" will show you who changed the owner of a file or a folder.

Detect Who Changed a File or Folder Owner with Native Auditing

Run Netwrix Auditor → Navigate to “Search” → Click on “Advanced mode” if not selected → Set up the following filters:
- Filter = “Data source”
  Operator = “Equals”
  Value = “File Servers”
- Filter = “Details”
  Operator = “Contains”
  Value = “Owner changed"
Click the “Search” button and review who changed file or folder owners.

Detect Who Changed a File or Folder Owner with Netwrix Auditor

To create an alert on file or folder owner changes:

From the search results, navigate to “Tools” → Click “Create alert” → Specify the new alert’s name.
Switch to the “Recipients” tab → Click "Add Recipient" → Specify the email address where you want the alert to be delivered.
Click “Add” to save the alert.

Quickly detect changes to file/folder ownership to mitigate the risk of data breaches

Every object on a file share has an owner. A file’s owner controls who has permissions to the object; full access permissions are particularly important because they enable the user to read, copy, delete and relocate the file. Therefore, any change of a file owner increases the risk of unauthorized access that could result in the loss or leakage of sensitive data. IT administrators must continuously monitor every change to a file owner and detect improper changes in order to mitigate the risk of data breaches and compliance failures.

Netwrix Auditor for Windows File Servers delivers complete visibility into what’s happening on your Windows file servers and provides actionable audit data about all changes made to files and folders, including a change of a file owner. The application also provides the current and past values for each change. These values help you quickly detect which file’s owner was changed, the old and the new name of the owner of the file, when and where the change was made, and — most important — who changed a file owner.

Previous How-to

How to Detect Who Deleted a Computer Account in Active Directory

Next How-to

How to Detect Who Granted Full Access Permissions to Another User’s Mailbox