INFO ON DELETED FILES
IN WIN2000 SERVER IF A FOLDER GETS DELETED
IS IT POSSIBLE TO FIND OUT WHICH USER AND WHEN IT WAS DELETED
Windows Forum
IN WIN2000 SERVER IF A FOLDER GETS DELETED
IS IT POSSIBLE TO FIND OUT WHICH USER AND WHEN IT WAS DELETED
by quintar51
it is possible, but only AFTER you enable auditing. If auditing is not turned on, then there's no way to find it.
To turn auditing on, you'll first need to make sure you're using an NTFS partition, then you'll need to edit group policy, and goto Computer Configuration->windows Settings->Security Settings->Local Policies->Audit Policy.
Enable audit object access (if it's a member server) or audit directory service access (if it's a domain controller). You can also audit for successfuland failed login attempts to have additional proof.
After that, you need to browse to the folder you want to audit, right click, properties, security, Advanced, Auditing tab, and then add the user you want to keep a track on. It's best to add Everyone or Domain Users, and check off 'delete'. This will track ANYONE who deletes this folder or any subfolders.
Check your security log periodically.
by quintar51
by geoffdougan
by geoffdougan
This discussion is closed to new replies.
Sort by Trending