How to Find Out if Someone Is Viewing Files on a Computer

Determining if someone has viewed your company's files helps you detect theft of proprietary information or determine that people are doing the work they're assigned. For example, if you've assigned work on a particular Word document to an employee, seeing that he's viewed the document helps you verify that he's performing the assigned task. Windows' security and administrative tools make these and related projects possible. The Local Security Policy controls turns on file auditing and a particular file's Security tab enables auditing for that file. Use the Windows Event viewer to view log entries that indicate access of the file.

Open the Windows Control Panel by right-clicking or pressing and holding on the Start button and choosing "Control Panel." Enter "admin" in the Control Panel search box and then click the "Administrative Tools" link.

Double-click the "Local Security Policy" shortcut to display a new screen with the same name. Click the navigation pane's "Local Policies" category and then click the pane's "Audit Policy" icon. The main pane displays a list of Windows resources that you can audit.

Double-click the main pane's "Audit object access" item to display the Audit Object Access dialog box. This screen has controls for auditing your PC's files.

Check the "Success" and "Failure" check boxes to turn on logging for successful and failed attempts at file access. Click "OK" to close the dialog box.

Use Windows Explorer (File Explorer in Windows 8) to navigate to a file that you want to monitor for user access. For example, navigate to a folder containing a Word document.

Click "Properties" from the file's context menu and then click the "Security" tab. Click "Advanced" and then click the Advanced screen's "Auditing" tab.

Click the "Continue" button to display a pane for creating auditing entries. Click the "Add" button and then click the "Select a principal" link that appears. "Principal" refers to the user whose file access activity you want to monitor.

Enter in the Object Name text area the user name of the person you want to monitor; enter your user name just for testing purposes. Click the "Check Names" button. Windows enters the full specification for your user name, which includes your PC's name. Click "OK" to close the dialog box.

Click the "All" option from the Type control to enable monitoring of successful and failed attempts to access the selected file. Check the "Read & execute" and "Read" check boxes under the Basic Permissions heading. This action tells Windows to log attempts to view the selected file. Click "OK" on both open dialog boxes to return to the file's Properties screen. Click "OK" to finish configuring the auditing settings.

Open and then close the file whose auditing settings you just configured. Jot down the system time, which helps validate the Event Viewer's log entries.

Click "Event Viewer" from the Start menu's context menu and then click the "Windows Logs" category. Click this category's "Security" icon to display log entries related to security.

Click the top item in the Security pane and then press "Ctrl-F" to open the Find dialog box. Enter a portion of the name of the document that you opened and closed. Event Viewer selects the most recent entry that has a reference to that document. The General pane's Object Name field displays the document's name and the time in the Logged field matches the time you wrote down. The Accesses field displays "ReadData," which indicates an attempt to view the document.

Open the Audit Object Access dialog box as you did in Step 3 and then uncheck the Success and Failure check boxes to prevent Windows from creating additional audit entries. Click "OK" to close the dialog box.