Need script to find who opened company server folders by date

Hello Ahmad Ibrahim,

To track which users opened folders on your company server, you’ll need to rely on Windows auditing logs rather than trying to code everything from scratch. The good news is that PowerShell can query these logs once auditing is enabled on the folders.

First, make sure auditing is turned on for the shared folders in question (right‑click the folder > Properties > Security > Advanced > Auditing). Once auditing is active, you can use PowerShell’s Get-WinEvent command to filter the Security log by Event ID 4663, which records file and folder access. For example:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663; StartTime='05/25/2026'; EndTime='05/28/2026'} | Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='Object';Expression={$_.Properties[6].Value}}

This script will show the time, user, and folder accessed between the dates you specify. You can adjust the StartTime and EndTime values to match your reporting window.

I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

Jason.