General discussion

Locked

INFO ON DELETED FILES

By geoffdougan ·
IN WIN2000 SERVER IF A FOLDER GETS DELETED
IS IT POSSIBLE TO FIND OUT WHICH USER AND WHEN IT WAS DELETED

This conversation is currently closed to new comments.

4 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

INFO ON DELETED FILES

by quintar51 In reply to INFO ON DELETED FILES

it is possible, but only AFTER you enable auditing. If auditing is not turned on, then there's no way to find it.

To turn auditing on, you'll first need to make sure you're using an NTFS partition, then you'll need to edit group policy, and goto Computer Configuration->windows Settings->Security Settings->Local Policies->Audit Policy.

Enable audit object access (if it's a member server) or audit directory service access (if it's a domain controller). You can also audit for successfuland failed login attempts to have additional proof.

After that, you need to browse to the folder you want to audit, right click, properties, security, Advanced, Auditing tab, and then add the user you want to keep a track on. It's best to add Everyone or Domain Users, and check off 'delete'. This will track ANYONE who deletes this folder or any subfolders.

Check your security log periodically.

Collapse -

INFO ON DELETED FILES

by quintar51 In reply to INFO ON DELETED FILES

Forgot to mention that in the security tab, deny the 'delete' right to the appropriate users. That way, they won't be able to delete the folder, and when they try, they'll be monitored.

Collapse -

INFO ON DELETED FILES

by geoffdougan In reply to INFO ON DELETED FILES

Poster rated this answer

Collapse -

INFO ON DELETED FILES

by geoffdougan In reply to INFO ON DELETED FILES

This question was closed by the author

Back to Windows Forum
4 total posts (Page 1 of 1)  

Related Discussions

Related Forums