Is it possible to monitor both the System32 & Syswow64 directories?

Article ID: 243
Category: Configuration
Applies to: 2.93 or newer
Updated: 2018-11-07

Yes, it is possible to monitor both of these directories on a 64-bit machine with the "Disable folder redirection on 64-bit systems (Wow64)" option in File Monitoring.

If you run the EventSentry agent on a 64-bit machine and monitor folders for which the OS has file redirection for 32-bit processes enabled (e.g. %SYSTEMROOT%\SYSTEM32), then the OS will automatically redirect them to their "Windows on Windows" counterpart. For example, C:\Windows\System32 would be redirected to C:\Windows\SysWOW64. Enabling this option will disable folder redirection on 64-bit systems.

Once that option is enabled, you can then add both as monitored directories (e.g. %SYSTEMROOT%\SYSTEM32 and %SYSTEMROOT%\SYSWOW64).

If you previously had "File Monitoring" deployed to a 64-bit machine without the "disable redirection" option enabled, this may result in some "false" alerts at first about file size change and file additions. This is because both directories have many of the same files however the SYSTEM32 directory has more files and some of these files are different sizes.