[Webinar] Streamline your web hosting managementRegister Today


Auditing deleted files / folders on a windows 2008 fileserver

Posted on 2010-04-02
Medium Priority
Last Modified: 2017-12-19
I have a windows 2008 fileServer that I cannot seem to audit the deleted files and or folders;
I go to the drive then go to the folder containing the shares that I want to audit, then right click and go to properties, then select the security tab, then select advanced down at the lower right, then select the auditing tab, hit edit and then click add, add domain users, I check the boxes delete suubfolders and files, and delete, then click okay. I've tried creating and deleting file and folders from the audited folders with no entries in the security log.
This is a domain environment
Question by:jmpatterson
  • 2
LVL 57

Accepted Solution

Mike Kline earned 2000 total points
ID: 29471675
Did you turn on auditing on the file server itself

Computer Configuration | Windows Settings | Security Settings | Local Policies | Audit Policy

Audit Object Access

Once you enable that then you do what you did on the folders.

You can set the policy locally or via a group policy linked at a higher level that applies to the file server



Author Closing Comment

ID: 31710324
I Should have remembered that! THANK YOU!!!
LVL 57

Expert Comment

by:Mike Kline
ID: 29475675
no problem, glad to help out.  Have a great weekend.


LVL 81

Expert Comment

ID: 42409360
your local policy might be overwritten by a domain GPO.
with DFS you have to make sure the same security permissions exist on all targets or you will run into a huge issue where one allows the move while the other does not and you will have data all over the place.

Are there common users to the folders that "move" sticky mouse issue.

run icacls

Using security and applying the deny delete to the specific folder only for all domain users, should prevent it from being moved.
test first. create a test folder, add the rule, and using a standard account, try to move it.

potentially the sticky mouse deals with users who view folder content in explorer view.

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes it necessary to set special permissions on user objects.  For instance when using a Blackberry server, the SendAs permission needs to be set. I see many admins struggle with the setting that permission only to see it disappear within a few…
I’m willing to make a bet that your organization stores sensitive data in your Windows File Servers; files and folders that you really don’t want making it into the wrong hands.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
Suggested Courses
Course of the Month7 days, 15 hours left to enroll

607 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question