Is there a way to view user tracks in Windows 7?

Question

If I'm the administrator of my computer can I view for example if someone opened a file, used a program, visited a website or did some action?

In other words is there a way to monitor the complete activity in my computer (Win7) without any third-party software?

Answer 1

You cannot if you have Windows 7 Home versions, but if you Have Windows 7 Pro or Ultimate, you can.

Open gpedit.msc and go to:

Computer Configuration>Windows Settings>Security Settings>Local Policies>Security Options

Enable any of the Audit policies, but especially "Audit: Force audit policy subcategory settings".

Then go to:

Computer Configuration>Windows Settings>Security Settings>Advanced Audit Policies Configuration>System Audit Policies – Local Group Policy>Object Access

Set the "Audit File System Policy" to configure both Success and Failure events. Do a gpupdate/force at an elevated command prompt.

Next go to the folder(s) you want to audit, and go to Properties>Security>Advanced>Auditing>Edit>Add and add whoever you want to audit. If you do this at the root of the drive, it will inherit all the way down unless inheritance has previously been blocked. After you hit Add and select them, you will be presented with a box to select what you want to audit. Click Full control for both Success and Failure.

All file accesses should now show in your Event Viewer>Windows Logs>Security node.

To answer your question below: Obviously the amount of data being collected for every file access can be voluminous. If you have your accounts well password protected, most administrators just look for access failures to see if people are trying to access material they are not entitled to. If you are trying to monitor kids at home, probably better is to use the Parental Controls feature linked here. Otherwise you need to use the filter options in the right pane.