General discussion

Locked

Deleted Files

By nderr ·
Is there a way to determine who deleted a networked storage file? Does Windows provide such a capability or do I need to find a third-party utility?

This conversation is currently closed to new comments.

7 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Deleted Files

by billc124 In reply to Deleted Files

What Network Operating System are you using? Novell or Windows NT/2000?

Collapse -

Deleted Files

by nderr In reply to Deleted Files

Poster rated this answer

Collapse -

Deleted Files

by Some Guy in Seattle In reply to Deleted Files

Windows comes with auditing facilities but these are disabled by default. Unless it has been enabled beforehand there is no way to find out that information. To set auditing, look at the properties of the file, folder, or directory you want to audit. Click Security and then Advanced. From here you can choose local or network accounts and the level of auditing that you want. It may take some tweaking to find the exact level of auditing you want vs. the size of the log files generated.

Hope that helps,

Collapse -

Deleted Files

by nderr In reply to Deleted Files

Poster rated this answer

Collapse -

Deleted Files

by duwaned In reply to Deleted Files

Answer 2 is correct, except that you will need to enable auditing first through User Manager for domains.

Open User Manager, click "Policies", then click "audit", and enable the auditing options you want. If you don't do this, you won't see the options referred to in answer 2.

Regards.
Duwane

Collapse -

Deleted Files

by nderr In reply to Deleted Files

Poster rated this answer

Collapse -

Deleted Files

by nderr In reply to Deleted Files

This question was closed by the author

Back to Windows Forum
7 total posts (Page 1 of 1)  

Related Discussions

Related Forums