Shared Folder Monitoring Software: Best for 2023

One of the biggest problem of sharing of folders in Windows XP is it uses the Simple File Sharing option by default whereby when you share a folder, anyone on the local network or even from the Internet would be able to access the shared folder without logging in or entering any password. Thankfully this has all changed starting from Vista where the Simple File Sharing option has been removed and you need to login with a user account or else you can’t access the shared folder. It is still possible to allow access to shared folders without a password by enabling the Guest account and giving permission to EVERYONE group on the shared folder.

Another problem with shared folders is sometimes you don’t know who is toying around with the files when a few people have access to it. If you go to Control Panel > Administrative Tools and run Computer Management, you can only view the connected session and the files being opened by the user in real time but without notification nor logging. This means an important file can be easily deleted from the shared folder and untraceable. Fortunately we have 7 ways for you to monitor shared folders to track down the culprit.

1. NetShareMonitor

NetShareMonitor is a free and portable tool to watch your shared folders. The program is has 3 tabs to show the active session, files being accessed, and also all the shared resources on your computer. When someone connects to your shared folder, the NetShareMonitor icon at notification area will start to blink and also plays an alert music. There is no popup/email notification nor automated actions to take when an access is detected. Tabs doesn’t show detailed information and will have to view the logs. The log files does not show the files are deleted, other than showing the files that are accessed. Last updated 5 years ago but works on Windows 7.

Download NetShareMonitor

---

2. ShareWatch

ShareWatch is a a very simple and small portable tool at only 77KB in size that does only one thing which is to show the connected user and also the files being accessed. There is no logging and notification, pretty much like the feature found in Computer Management. One advantage in using ShareWatch is that it can watch other computer’s shared folders given that you have proper access to the computer.

Download ShareWatch

---

3. ShareMonitor

ShareMonitor is yet another portable tool that instantly starts monitoring your shared files upon running the program. The activities are displayed in a spreadsheet like format with cells that resembles Excel and can be saved to a CSV or XML file for future references. By default ShareMonitor checks every 500 milliseconds which will constantly take up 3-6% CPU usage.

Download ShareMonitor

---

4. ShareWatcher

Although the latest version 3 of ShareWatcher is shareware and its free version is heavily crippled, version 2 which is a year older can be used without limitations or nag screens. The program is able monitor and log the file adding or accessed activity of your folder shares in real time, with the added ability to also monitor remote or FTP shared folders for new files. In addition to the log in the main window, you can also be notified via a tray icon popup. To avoid being upgraded to free version 3 which has most of the features disabled, it’s best to turn off automatic updates in Settings.

Download ShareWatcher

5. System Tray Share Monitor

This tool was first released on 2002, last updated in 2007 and designed to work on Windows XP but still works in Windows 7. Upon running, System Tray Share Monitor monitors and logs incoming connections and the files that are being read and written. There is no notification and double clicking on the tray icon will show a small bar of the user and IP address connected to your shared folder. Double clicking on the user name will bring up another window showing the files currently being accessed.

Download System Tray Share Monitor

---

6. WhoIsConnected

WhoIsConnected comes with a unique feature called “Disable Login” which is very useful if you want to quickly stop anyone from accessing your shared folders with a single click of a mouse button. Unfortunately Disable Login feature only works on Windows XP but not on Vista and 7. The connection notification can be enabled from the Options window where a notification window will be displayed when someone accesses your shared folder. There is no log support on this tool.

Download WhoIsConnected

---

7. The Manual Way

If you’ve gone through all 6 programs above, you may have noticed that there is no perfect tool that comes with all features to monitor your shared folders such as logging, notification, actions and etc. Although they can all tell which files are being accessed and who is accessing them, it is still not possible to show the exact actions by the users such as if the files are being copied or deleted since it only shows read or written. If you need detailed logging information, there is actually a way to enable auditing without using third party tools but it requires more steps. Here is how to do it in Windows 7.

1. Click on the Start button, type Local Security Policy and press Enter.

2. Expand Security Settings > Local Policies > Audit Policy > and double click on Audit Object Access.

3. Tick on the Success checkbox and click OK.

4. Right click on the shared folder that you want to monitor and select Properties.

5. Go to Security tab and click the Advanced button.

6. Go to Auditing tab and click the Edit button.

7. Click the Add button, type EVERYONE at the object name box and click OK.

8. An auditing entry window will open allowing you to log the actions that you want. If you want to monitor deletion of files and folders, simply tick the “Delete subfolders and files” and “Delete” successful checkboxes. Do not tick everything because that will easily fill up the event logs making it harder for you to audit.

Whenever a file on the shared folder which you have enabled auditing is deleted, it will be logged and can be viewed from Event Viewer. Go to Control Panel > Administrative Tools > Event Viewer. Expand Windows Logs and click on Security. The event below is an example of a file x-ray.exe being deleted from the shared folder by the 192.168.2.17.