Failed NTFS directory access over SMB is not detected

Hello,

We are testing PA File Sight Ultra 10.2 (Build 246) on Windows Server 2022 and have encountered an issue with detecting failed NTFS directory access attempts over SMB.

Environment:

• File server: Windows Server 2022 Standard
• PA File Sight Ultra 10.2, Build 246
• Access via an SMB network share
• A dedicated File Access Monitor configured for a specific directory
• The monitored directory has restrictive NTFS permissions. The test user has no access to it.

Monitor configuration:

• Directory to monitor: F:\obmen\test
• Monitor subdirectories: Enabled
• Directory Activities: All enabled
• Event result filtering: Both successful and failed
• Fire actions for directory activities: Enabled
• Record events to database: Enabled
• Alert action: Message Box

Test results:

1. Accessing the directory through Windows Explorer does not generate a failed access event.
2. Running dir "\\files1\obmen\test" from the client displays "File not found", even though the directory contains a text file.
3. Running icacls "\\files1\obmen\test" returns "Access is denied".
4. We also tested a direct Windows API call to CreateFileW from the client, requesting FILE_LIST_DIRECTORY (0x00000001) with OPEN_EXISTING and FILE_FLAG_BACKUP_SEMANTICS.

The direct API call returned:

CreateFileW FAILED. Win32 error: 5 (Access is denied)

However, PA File Sight did not record any event for this failed operation.

For comparison, successful directory access operations are detected correctly, and the configured alert action works.

We previously contacted support and were advised that Windows Explorer might check ACLs before actually attempting access. Therefore, we performed the direct CreateFileW test to eliminate this possibility.

Questions:

1. Is PA File Sight expected to detect failed CreateFileW operations requesting FILE_LIST_DIRECTORY over SMB?
2. Which Directory Activity should be generated for this operation?
3. Are there any additional settings required to capture failed NTFS directory access attempts?
4. If this should work with our current configuration, what diagnostic information or logs would help investigate the issue?

Our goal is to receive an alert whenever a user attempts to access a restricted directory and NTFS denies access.

Thank you.