Tracking file deletion to client computers
I have an application server running 2003. There is ai share a folder and with full rights to all client computers running XP Professional. Unfortunately a user deleted a file through the network.How can we track who deletes the files or folder?
ASKED:
Nov 11, 2008 5:34 PM GMT
UPDATED:
November 12, 2008 6:10:37 PM GMT
RELATED QUESTIONS
- Outlook 2007 can't delete from deleted items
- Microsoft Outlook 2003 Auto-Archive feature won't archive email
- Deleted files reappear after logging on Windows Server 2008
- Lotus Script programming error
- Deleted emails showing up in Vista search, but says file is not there...
- Password Recovery
- iSeries IFS on MAC client
- VB.NET CLIENT/SERVER APPLICATION
- Password Protection at Folder Level in Citrix
- how do i get offline files on a client computer to sync to the new server its folder has been redirected to
Answer Wiki:
You would have to use a third-party application to accomplish this.
------------------
You could enable object access auditing to track deletions in the future.
To do that, you need to enable auditing (through group policy or local security policy), and then identify the folder you want to audit and set the appropriate settings.
To enable auditing through local security policy, go to Start -> All Programs -> Administrative Tools -> Local Security Policy.
In the Local Security Policy tool, expand "Local Policies" and select Audit Policy.
Double click on the "Audit Object Access" item and choose what events you want to audit.
Once enabled, right click on the shared folder, select "properties" -> "security" -> "advanced", go to the "auditing" tab, and set the appropriate settings.
The audit results will be included in the "security" section, in event viewer.
------------------
You could enable object access auditing to track deletions in the future.
To do that, you need to enable auditing (through group policy or local security policy), and then identify the folder you want to audit and set the appropriate settings.
To enable auditing through local security policy, go to Start -> All Programs -> Administrative Tools -> Local Security Policy.
In the Local Security Policy tool, expand "Local Policies" and select Audit Policy.
Double click on the "Audit Object Access" item and choose what events you want to audit.
Once enabled, right click on the shared folder, select "properties" -> "security" -> "advanced", go to the "auditing" tab, and set the appropriate settings.
The audit results will be included in the "security" section, in event viewer.
60,255 pts.
To see other answers submitted to the Answer Wiki View Answer History.
