I am running Windows Server 2003 R2 and three times now a folder has been deleted from a user’s network drive. No one has access to this except me and the user and from what the user says, she isn’t doing anything wrong. She logs in and the folder is gone. I am able to recover from backup, but that’s not the point. Is there any way to find out who or when a file is deleted either in the Event Viewer or otherwise?
