Auditing deleted files in File Server

By kit_eizenga ·
Right now I have someone deleting user folder's off of the File Server. I have set Auditing for the Everyone Group on that drive. What events. am I looking for to find the culprit?

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

Security Logs with event ID 560

by neilb@uk In reply to Auditing deleted files in ...

Should show up whatever you're auditing.

Collapse -

chnge reportr

by Harold123 In reply to Auditing deleted files in ...

You should take a look at the NetWrix File Server Change Reporter. It will tell you exactly who is making what changes to your file server. As far as I know this product takes all reqired events and reports on them. Automated reports tell you any time a change has been made, with information regarding who, what when and where each given change was made, also including before and after values of any changes. There is a free version, but the commercial version is best for your purposes, as it will tell you who is deleting the user folders (because freeware is crippled a bit and won?t who you WHO? only WHAT).

Related Discussions

Related Forums