Re: Tracking deleted files

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

You can setup Auditing of the folders through gpedit.msc:

Domain Controllers, Windows Settings, Security Settings, Local Policies,
Audit Policies. - Audit Object Access (success & Fail).

Add the names to the Audit tab to audit the following:
Create Files/Write Data; Create Folders/Append Data; Write Attributes; Write
Extended Attributes; Delete Subfolders and Files; Delete.

And you can use the following to help manage your Event Log:

http://www.eventlogmanager.com//subpass/landing.htm
http://www.eiqnetworks.com/products/EnterpriseSecurityAnalyzer.shtml


--
Jabez Gan [MVP]
Microsoft MVP: Windows Server
http://www.blizhosting.com
MSBLOG: http://msblog.resdev.net


"JL Adamson" <JLAdamson@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:9AB9F2FA-5025-4773-8FB7-8CC6BA8D5525@xxxxxxxxxxxxxxxx
I have a 2003 server acting as a fileserver and I suspect that users are
delteing files they aren't supposed to. The disk space on the drive has
changed wildly the last week. Everything seems to be running fine but I
want
to make sure.

Is there any way to find out what files have been deleted from the server?


.

Relevant Pages

  • Re: Audit Logons/Logoffs
    ... Do I enable it at Domain Level, Default Domain Policy, Computer ... Configuration, Windows Settings, Security Settings, Local Policies - Audit ...
    (microsoft.public.win2000.group_policy)
  • Event ID 538 not recorded for user logoffs.
    ... I've double-checked the Local Security Policy | Local Policies | Audit ... Policies | Audit Logon Events and both the effective setting and local ...
    (microsoft.public.security)
  • Re: Detection of file copies
    ... Audit User Access of Files, Folders, and Printers in Windows XP - http://support.microsoft.com/Default.aspx?kbid=310399 ... Audit Active Directory Objects in Windows Server 2003 - ...
    (microsoft.public.security)
  • Re: Finding the last person to open a file.
    ... Auditing, and configure the folder/file that you want to audit. ... How to enable and apply security auditing in Windows 2000 ... Audit Active Directory Objects in Windows Server 2003 ...
    (microsoft.public.windows.server.active_directory)