Is there anyway to tell which user deleted a file?

Hi Everyone,

There is a network share that a few people have access to and recently some files have been deleted.  There is some question as to who deleted them.  Is there anyway to check this in Active Directory or somewhere else within the DC?

Who is Participating?
Wonko_the_SaneConnect With a Mentor Commented:
If auditing on the server hosting the file was enabled, plus the auditing was configured for this file, then yes. In this case you will see in the security log of the file server. This is something that is not enabled by default, so if this wasn't done prior to the deletion you will probably not be able to tell who did it.
iUsernameConnect With a Mentor Commented:
I haven't heard of something that can actually do that, but If you're interested in something that might cost some money, I've heard of a company called covertix that they're product can tell you what is happening to your files and who is doing what.
JsmplyAuthor Commented:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.