Auditing deleted files / folders on a windows 2008 fileserver
I have a windows 2008 fileServer that I cannot seem to audit the deleted files and or folders;
I go to the drive then go to the folder containing the shares that I want to audit, then right click and go to properties, then select the security tab, then select advanced down at the lower right, then select the auditing tab, hit edit and then click add, add domain users, I check the boxes delete suubfolders and files, and delete, then click okay. I've tried creating and deleting file and folders from the audited folders with no entries in the security log.
This is a domain environment
I go to the drive then go to the folder containing the shares that I want to audit, then right click and go to properties, then select the security tab, then select advanced down at the lower right, then select the auditing tab, hit edit and then click add, add domain users, I check the boxes delete suubfolders and files, and delete, then click okay. I've tried creating and deleting file and folders from the audited folders with no entries in the security log.
This is a domain environment
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
no problem, glad to help out. Have a great weekend.
Thanks
Mike
Thanks
Mike
your local policy might be overwritten by a domain GPO.
with DFS you have to make sure the same security permissions exist on all targets or you will run into a huge issue where one allows the move while the other does not and you will have data all over the place.
Are there common users to the folders that "move" sticky mouse issue.
run icacls
Using security and applying the deny delete to the specific folder only for all domain users, should prevent it from being moved.
test first. create a test folder, add the rule, and using a standard account, try to move it.
potentially the sticky mouse deals with users who view folder content in explorer view.
with DFS you have to make sure the same security permissions exist on all targets or you will run into a huge issue where one allows the move while the other does not and you will have data all over the place.
Are there common users to the folders that "move" sticky mouse issue.
run icacls
Using security and applying the deny delete to the specific folder only for all domain users, should prevent it from being moved.
test first. create a test folder, add the rule, and using a standard account, try to move it.
potentially the sticky mouse deals with users who view folder content in explorer view.
ASKER