Q:
Tracking file deletion to client computers
I have an application server running 2003. There is ai share a folder and with full rights to all client computers running XP Professional. Unfortunately a user deleted a file through the network.How can we track who deletes the files or folder?
ASKED:
Nov 11 2008 5:34 PM GMT
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
A:
RATE THIS ANSWER
0
Click to Vote:
0
Click to Vote:
- 0
0
------------------
You could enable object access auditing to track deletions in the future.
To do that, you need to enable auditing (through group policy or local security policy), and then identify the folder you want to audit and set the appropriate settings.
To enable auditing through local security policy, go to Start -> All Programs -> Administrative Tools -> Local Security Policy.
In the Local Security Policy tool, expand "Local Policies" and select Audit Policy.
Double click on the "Audit Object Access" item and choose what events you want to audit.
Once enabled, right click on the shared folder, select "properties" -> "security" -> "advanced", go to the "auditing" tab, and set the appropriate settings.
The audit results will be included in the "security" section, in event viewer.
