I've enabled audit logs on several folders on windows server 2003 environment. It records the deleted action on folder and sub-folder.
The problem is I want to make sure, that when I see Delete in Accesses field, it is for certain the user deleted the folder/file.
When replicating the action, it only shows (delete), I'm not sure, what the rest if for.
I filtered the logs to Object Access, Event ID: 560
So My question is, how to determine that the folder/file is indeed was deleted by that user??
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
Free Guide: Managing storage for virtual environments
Complete a brief survey to get a complimentary 70-page whitepaper featuring the best methods and solutions for your virtual environment, as well as hypervisor-specific management advice from TechTarget experts. Don’t miss out on this exclusive content!