Windows Forum·65,706 discussions

Deleted Files

Locked

Is there a way to determine who deleted a networked storage file? Does Windows provide such a capability or do I need to find a third-party utility?

Topic

Deleted Files

In reply to Deleted Files

What Network Operating System are you using? Novell or Windows NT/2000?

Deleted Files

In reply to Deleted Files

Poster rated this answer

Deleted Files

In reply to Deleted Files

Windows comes with auditing facilities but these are disabled by default. Unless it has been enabled beforehand there is no way to find out that information. To set auditing, look at the properties of the file, folder, or directory you want to audit. Click Security and then Advanced. From here you can choose local or network accounts and the level of auditing that you want. It may take some tweaking to find the exact level of auditing you want vs. the size of the log files generated.

Hope that helps,

Deleted Files

In reply to Deleted Files

Poster rated this answer

Deleted Files

In reply to Deleted Files

Answer 2 is correct, except that you will need to enable auditing first through User Manager for domains.

Open User Manager, click “Policies”, then click “audit”, and enable the auditing options you want. If you don’t do this, you won’t see the options referred to in answer 2.

Regards.
Duwane

Deleted Files

In reply to Deleted Files

Poster rated this answer

Deleted Files

In reply to Deleted Files

This question was closed by the author

[Author]

Replies