File Tracking Guide

  Add-On Product Guides

Our Employee Monitoring software can track the following File Tracking events:

IMPORTANT: Currently, file tracking is available for Windows-based machines only.

  • File Created: When a file is added/created on a monitored path or drive
  • File Modified: When a file modification timestamp is updated. This can occur when the file is updated (new version of a document file is saved) or file properties are modified.
  • File Deleted: When a file is deleted from a monitored path or drive.
  • File Renamed: When a file is renamed. InterGuard will capture both the original File Name and the new File Name.


For each of the file events above, InterGuard will capture the following data from the monitored user:

  • Computer Name
  • Windows User Name
  • Timestamp when event occurred
  • Event Type (as explained below)
  • Full folder/file name and directory of file. 

Configuring paths to track for File Tracking

By default, the software will not monitor file events unless paths are explicitly entered in File Tracking settings.

  1. File tracking must first be enabled in Recording and Blocking for the required User Group.
  2. You can edit your File Tracking settings by clicking the blue edit icon.
  3. Paths can then be added for monitoring of file tracking events.


  • Paths that are added to File Tracking are recursive, so they will monitor file events in all sub-directories.
  • There is no limit to the number of paths that can be added.
  • The software will monitor file modification events but not folder modification events.
  • Both local and network drives can be added. For Network drives, the UNC path must be added and will monitor when a user is modifying files on a remote network through folder explorer via the UNC path share EXAMPLE: \\SERVERNAME\c$\USER
  • Since all files in the selected directories will be tracked, this may also include files that are programmatically modified by applications. As such we have pre-checked the box to “Ignore events from system files” to reduce the number of reported events for file types that are commonly used explicitly by applications.