• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 199
  • Last Modified:

Need to find out who is deleting network files

We continue having network files that are being deleted, however, they are being deleted off of shares that have ALOT of different users that are allowed to modify them.  If an entire folder is deleted off of a network drive, is there any way to look and see who could have deleted it.  I am able to restore these from backups everytime, but I would like to find and educate the user that is doing it.

Shares are on a Win 2k3 server running in a Win 2k3 AD environment.
1 Solution
You need to enable auditing of object access (sucess) and then configure the folder audit delete

This article http://support.microsoft.com/kb/310399 is for XP but 2003 is essentially the same.

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now