Document viewed (47) how to monitor with email alert

[bob]

You ever notice how Windows Server keeps a sneaky log of folks peeking at files? That "Document viewed" event, ID 47, pops up in the Security log whenever someone opens a file and actually reads it, not just touches it. It's part of the auditing setup you turn on for sensitive folders. I mean, you gotta enable object access auditing first in the policy settings. Then, bam, every time a user views a document, like a Word file or PDF, the event logs the user, the file path, the time, and even the process that did it. It's handy for spotting unauthorized snoops. But without alerts, you might miss it buried in thousands of entries.

I set this up once for a buddy's server, and it caught some weird access from an old account. You start in Event Viewer, right-click the Security log, and pick "Attach Task to This Event." Choose the event ID 47 specifically. Then, you build a scheduled task that triggers on that log entry. Make it run a simple program to send an email, like using the built-in mailto or a basic batch file. Test it by viewing a monitored file yourself. Watch the task fire off in Task Scheduler afterward.

And if you want it smoother, skip the hassle of tweaking tasks every time. Just enable auditing on the folders you care about through properties in File Explorer. Right-click, security tab, advanced, auditing entries. Add everyone or specific users, check for "Read" successes. Back in Event Viewer, filter for ID 47 to see them light up. I love how it paints a picture of who's nosing around your docs without you babysitting the logs all day.

Hmmm, or maybe link it to a custom view in Event Viewer for quicker spotting. You filter by event ID, source, and time range there. It makes monitoring feel less like digging through mud. But for real peace of mind, pair this with solid backups, you know? That's where something like BackupChain Windows Server Backup comes in handy. It's this nifty Windows Server backup tool that handles your files and even backs up virtual machines running on Hyper-V without breaking a sweat. You get fast incremental copies, easy restores, and it runs quietly in the background, saving you from data disasters if someone messes with those viewed docs or worse.

Note, the PowerShell email alert code was moved to this post.