Windows Forum

Ask something
Discussion Locked

File deleted...!

0 helpful
10 replies

by wongcm

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
i have one Windows 2000 advance server running as file sharing server. This server link to an NT domain. The problem is user alway complaint that their data keep in the share folder alway being deleted by other who share the same folder. Is there any way to keep log of all this activities. Can the Eventlog do this or i need additional tools to solve tihs problem. I just need to know who delete or move the file from any share drive.

10 replies

by gigelul

A posibility is to enable an audit for this shares which records the actions of the users in events.

by gigelul

Use from menu chose type in domain <\\ComputerName> and then from Policies\Audit you can enable which events you want to be registered.

by wongcm

I try to log the problem using my Windows 2000 server rather than the Windows NT (primary domain).. Can that be done... How?

by gigelul

For a dialogue post only comments.
The solution that I give you in previous answer is exact you want.
\\ComputerName -replace with the name of your Win2000 server.

by wongcm

You mean i can log whose is the bad guy who delete the file from my Win2k file sharing server base on their username assign. Please help..

by gigelul

I don't have a Win2000 box to describe you exact steps but if you can work from NT-PDC you can follow these instructions (or find similar steps on Win2000).
Working on NT-PDC:
-open User Manager for domain
-from menu : User\select domain ? type in box the name of your Win2000 server (\\Win2000ServerName)
-from menu: Policies\Audit ? enable (here you can select all types of events)
-close User Manager
-open Windows explorer, browse for share where you want to enable audit.
-right clik on share and chose properties
-in security tab clik on auditing buton
-here you have two options (only root directory or all subdirectories and all files) also select what events you wish to be record in events of your Win2000 Server
That is all.

by gigelul

Also remember that events can be ambiguous.
If a word document is modified and saved you will receive a "delete events" because in save process the old document is deleted and replaced with the new doc (no matter if the name of the file is same).

This discussion is closed to new replies.