We keep having folders mysteriously being moved from one directory to another or being deleted. I have set up auditing on these directories but am having difficulty translating the entries in the event viewer. I set the auditing up to track "Delete Subfolders and files" & "Delete".
What parts of the log entry will inform me if a file/folder has been deleted or moved?
Many thanks in advance!