Discussion Locked

INFO ON DELETED FILES

0 helpful
4 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

IN WIN2000 SERVER IF A FOLDER GETS DELETED
IS IT POSSIBLE TO FIND OUT WHICH USER AND WHEN IT WAS DELETED

4 replies

by quintar51

it is possible, but only AFTER you enable auditing. If auditing is not turned on, then there's no way to find it.

To turn auditing on, you'll first need to make sure you're using an NTFS partition, then you'll need to edit group policy, and goto Computer Configuration->windows Settings->Security Settings->Local Policies->Audit Policy.

Enable audit object access (if it's a member server) or audit directory service access (if it's a domain controller). You can also audit for successfuland failed login attempts to have additional proof.

After that, you need to browse to the folder you want to audit, right click, properties, security, Advanced, Auditing tab, and then add the user you want to keep a track on. It's best to add Everyone or Domain Users, and check off 'delete'. This will track ANYONE who deletes this folder or any subfolders.

Check your security log periodically.

by quintar51

Forgot to mention that in the security tab, deny the 'delete' right to the appropriate users. That way, they won't be able to delete the folder, and when they try, they'll be monitored.

This discussion is closed to new replies.