General discussion

Locked

Find a saboteur who deletes files!

By luciusism ·
Someone is deleting the files on our network! We have Win98 and NT servers. We have the basic security system using domain groups, however there are so many users that this alone cannot localize the culprit. What I need help is how to set up auditing correctly, and do I have to set it up for all the users in the network? I'm only looking to audit file deletion. We need to find the person who is deleting our files! Thanks!!!

Luc
IT

This conversation is currently closed to new comments.

16 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Find a saboteur who deletes files!

by M. Lacombe In reply to Find a saboteur who delet ...

You should be able to go to your server. Right click on the appropriate directories that you want to monitor and go to Properties. Choose the security tab and go to Auditing.

Collapse -

Find a saboteur who deletes files!

by luciusism In reply to Find a saboteur who delet ...

The question was auto-closed by TechRepublic

Collapse -

Find a saboteur who deletes files!

by turambar386 In reply to Find a saboteur who delet ...

Hi Luc. If you need to audit all deletions on all files on your network and are limited to the NT admin tools, you're in for a bit of work. Also, you will not be able to audit deletions on Win98 machines.

To enable auditing on an NT server or Workstation, you must go into User Manager and enable auditing. You do not need to check off any of the options, however.

Next, on each server and workstation, go to whatever drive, folder, or specific file you want to audit. Right-click, chose properties, go to the security tab, and click the Audit button. Click 'Add', choose Everyone, then hit OKAY. Then, check off success and failture for the delete action. Voila.

Collapse -

Find a saboteur who deletes files!

by luciusism In reply to Find a saboteur who delet ...

The question was auto-closed by TechRepublic

Collapse -

Find a saboteur who deletes files!

by shmaltz In reply to Find a saboteur who delet ...

Why not deny the right of deleting files on the shares this happens Plus setting up an Audit. On win9x machine there is nothing you can do to find out who is deleting the files you can just deny full prmision on the share.

Collapse -

Find a saboteur who deletes files!

by luciusism In reply to Find a saboteur who delet ...

The question was auto-closed by TechRepublic

Collapse -

Find a saboteur who deletes files!

by spn In reply to Find a saboteur who delet ...

HI there i can see the problem,get hold of a program called Task Monitor(get download trail from taskmon.com

A nice program that will run in the backgroud ,of win9x and NT platforms,it might audit deletions(i only played around with it out of intrests sake) and applications opened ,etc,etc via username not ideal but I don't know of a better solution other than implamenting a full NT enviorment.(but i'll keep my eyes open.
Hope U Catch the culprit
SPiNner

Sadly its not totaly free so if you want the full funcunality youll have to pay

Collapse -

Find a saboteur who deletes files!

by spn In reply to Find a saboteur who delet ...

Also try 007 Stealth Activity Recorder
download from tucow.com

Collapse -

Find a saboteur who deletes files!

by luciusism In reply to Find a saboteur who delet ...

The question was auto-closed by TechRepublic

Collapse -

Find a saboteur who deletes files!

by pbgerrard In reply to Find a saboteur who delet ...

I am not sure how you can adit on both NT and 98, but if you use the system policy editor, which comes with Windows, you can make users unable to delete files period. OR you could restrict which files they can delete.

Back to Windows Forum
16 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums