Windows Forum

Ask something
Discussion Locked

Using Audit trail in NT 4.0

0 helpful
6 replies

by joycetm

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello,

I would like to find out if I am able to check who deleted files on a NT 4.0 server using the audit trail.

What sort of information can I get from an audit trail - does it just indicates who and when the person is using the system or files?

Appreciate any feedback from anyone.

THank you,
Joyce

6 replies

by cavedweller

Yes, auditing can tell you who deleted a file by filename, date and time. You need to turn on auditing in advance. File auditing will generate a lot of data quickly so make sure you have the space to store the log.

by mike o

You can check logins, login attempts, file deletion, and more. If you go in and browse through the various options, you'll see there's a LOT of things you can track. Just be careful you don't get overzealous. As mentioned above, you can fill a lot of space quick. Especially on a busy network.

by joycetm

Thank you for your responses - so how do I activate audit trail logging to check on deletion of files?

Regards,
Joyce

This discussion is closed to new replies.