Auditing File and folder deletion.
From: DMI (DMI_at_discussions.microsoft.com)
Date: 10/25/04
- Next message: Mark Stanfill [MSFT]: "Re: Mea Culpa, I've killed OWA/RWW/Other stuff with NET STOP"
- Previous message: Kevin Weilbacher [SBS-MVP]: "Re: GroupWise to Exchange"
- Next in thread: John Bay: "RE: Auditing File and folder deletion."
- Reply: John Bay: "RE: Auditing File and folder deletion."
- Messages sorted by: [ date ] [ thread ]
Date: Mon, 25 Oct 2004 12:01:07 -0700
I am trying to setup an audit to keep track of who, when and what file(s) and
folder(s) deletions occurred on a couple of servers and it seems as it is not
working.
This is what I did:
=> At the Domain Controller: Admin tools\Active directory users and
computers right click properties. Group policy select policy to edit
(default) and edit. Under Computer config, expand Windows settings, security
settings, local policies and audit policy. Double click the Audit object
access and check the Define these policy settings and Success.
=> At the server where the files are:
Windows explorer right click the files and folders I want to audit, choose
security and advance. In the access control setting select auditing tab. I
selected the group "Domain users" to monitor the actions. I selected the
Delete and delete file and folders and check the success box next tot it.
Finally I click OK.
Questions
Please advise if I am doing something wrong?
Is this the correct way to do this?
What should I look for in the security event viewer?
Should I look into the event viewer of the server or DC?
Please reply with any suggestion you my have.
Thank you!
- Next message: Mark Stanfill [MSFT]: "Re: Mea Culpa, I've killed OWA/RWW/Other stuff with NET STOP"
- Previous message: Kevin Weilbacher [SBS-MVP]: "Re: GroupWise to Exchange"
- Next in thread: John Bay: "RE: Auditing File and folder deletion."
- Reply: John Bay: "RE: Auditing File and folder deletion."
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
