Yes, but it is not enabled by default and has to be configured manually through Group Policy and folder level SACLs. Even once configured, a windows file audit log produces raw security events in the Windows Event Viewer rather than a readable history, and on setups using shared logins it often cannot identify a specific individual.

Individual users can see recent changes, shares and comments on a file through Nextcloud’s built in Activity app. Administrators can see the full picture, including logins, deletions and sharing activity across every user, in Administration Settings under Logging, once the admin_audit app is enabled.

On a Windows file server, this means enabling object access auditing through Local Security Policy or Group Policy, then configuring a SACL on each folder that needs to be tracked. On Nextcloud, it means enabling the built in admin_audit app, which then logs file and account activity automatically without folder by folder configuration.

Identify users by name rather than shared logins, log the full range of file activity rather than just edits, store the log separately from the files it describes, set retention to match your actual compliance obligations, review logs periodically, and confirm logging continues correctly after software updates.

Audit logging means keeping a permanent, timestamped record of user activity on a system, in this context who accessed, changed, deleted, downloaded or shared a file, and when, tied to a real identity rather than a device or shared account.

An audit log file is the stored record produced by audit logging: a chronological file, or set of entries in a database or log management system, showing each recorded action, the time it occurred, and who performed it.

Nextcloud logs are found in Administration Settings under the Logging section, which displays both the standard system log and the optional admin_audit log once enabled. By default, the underlying log files sit in the server’s configured data directory, though a managed Nextcloud provider can route and retain them differently to suit compliance needs.