General discussion

Locked

Who deleted files?

By robert ·
Anybody know a way to determin WHO deleted files on a NT 4.0 server?

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Who deleted files?

by santhony In reply to Who deleted files?

Activate your Security Event viewer to log file activities. Insure you set the file large enough to record the data and monitor it regularly to limit the size of the file created.

Collapse -

Who deleted files?

by robert In reply to Who deleted files?

The question was auto-closed by TechRepublic

Collapse -

Who deleted files?

by guy In reply to Who deleted files?

Firstly he partition on your server MUST be formated NTFS. Consider CONVERT program if FAT e.g. dos prompt Convert /?
Assuming its NTFS, you firstly need to go to the User Manger and turn on Auditing, second set of check boxes = File and Print.
Then go to the file or folder where the files are and go to Properties, Security Tab, select Auditing. I would Audit the group everyone, just for Delete Success, otherwise your log will fill up.

Collapse -

Who deleted files?

by robert In reply to Who deleted files?

The question was auto-closed by TechRepublic

Collapse -

Who deleted files?

by robert In reply to Who deleted files?

This question was auto closed due to inactivity

Back to Windows Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums