Re: Tracking down missing files and the toad who deleted them

From: Ramesh [MVP] (ramesh_at_nojunkmails.com@mvps.org)
Date: 11/29/04 

Date: Mon, 29 Nov 2004 21:34:31 +0530

As Carey said. But, in future you can set auditing for selected folders/files (for XP Pro only)

How To Audit User Access of Files, Folders, and Printers in Windows XP:
http://support.microsoft.com/default.aspx?scid=kb;en-us;q310399&sd=tech

Microsoft Windows XP - Set, view, change, or remove auditing for a file or folder:
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/acl_audit_file_folder.mspx

Once you gather the required details, you should turn off auditing for the object(s), otherwise the Security log will become full very soon. 

-- 
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org
"Nobody in particular" <Sombody@sbcglobal.net> wrote in message news:i0hmq0pnm8otnebkk6ul6e776ml9sfq0h5@4ax.com...
Someone on my home network or maybe at my pc deleted files. How can I
determine when this was done or if it was done from another computer?
They're not in the recycle bin.

Relevant Pages

  • Re: audit access to cmd.exe
    ... You turn on accessing of all objects, then you set auditing on the ... > 1) secpol.msc--Security Settings, Local Policies, Audit Policy. ... > "George Hester" wrote in message ...
    (microsoft.public.security)
  • Re: Audit files
    ... The other posters did a great job explaining what to do but FYI auditing ... fine tune what folders/files you are auditing and only audit the bare number ... of permissions needed to find the information that you need. ... > I need to audit any folders and files in a share drive. ...
    (microsoft.public.windows.server.security)
  • Re: file security
    ... In general you need to set auditing for success and/or failure ... as needed in the Audit Policy section of a GPO that has the ... Then, in specific, you need to set auditing in the security ...
    (microsoft.public.windows.server.security)
  • Re: How to apply file/folder auditing
    ... options from the auditing tab of a shares properties. ... with this in favor of a gropu policy. ... > the ability to set auditing of files and folders. ... > those servers you want to audit in there own Organizational Unit and apply ...
    (microsoft.public.win2000.security)
  • Re: hacked afterthought, tools
    ... If you had auditing of object access enabled and then audited ... folders/files you might have an idea who accessed data and when but it is not ... thousands and thousands of events in the security log. ... Encryption of data and removal and securing of all ...
    (microsoft.public.win2000.security)