Auditing deleted files / folders on a windows 2008 fileserver
Posted on 2010-04-02
I have a windows 2008 fileServer that I cannot seem to audit the deleted files and or folders;
I go to the drive then go to the folder containing the shares that I want to audit, then right click and go to properties, then select the security tab, then select advanced down at the lower right, then select the auditing tab, hit edit and then click add, add domain users, I check the boxes delete suubfolders and files, and delete, then click okay. I've tried creating and deleting file and folders from the audited folders with no entries in the security log.
This is a domain environment