Connector Overview

File Access Manager Windows FS Activity Monitor uses a Microsoft certified mini-filter driver

https://msdn.microsoft.com/en-us/library/windows/hardware/dn265170(v=vs.85).aspx

The driver intercepts all I/O calls to determine which users have access to which files/folders, and also audits Changes to local users and groups. There is therefore no need for Windows auditing, and no performance overhead is introduced on the monitored server.

The activity monitor detects which share was used to perform each operation . Local access is a special cases, as detailed below:

Local Access

The system reports local access to a file/folder (for example, by using Remote Desktop) on the administrative share (C$), and a special field on the activity (“Is Local Access”) is set to “True.”