Theodosios
asked on
Investigation - Auditing in Windows 2003
Hi Everyone,
We have an incident where someone accessed a share drive last week and deleted a whole bunch of important files. The files were on a Windows 2003 server, standalone, no domain.
Unfortunately, auditing was NOT turned on. I've since turned it on, for future monitoring, but is there any way to track this incident as things stand?
Thanks in advance,
Theo
We have an incident where someone accessed a share drive last week and deleted a whole bunch of important files. The files were on a Windows 2003 server, standalone, no domain.
Unfortunately, auditing was NOT turned on. I've since turned it on, for future monitoring, but is there any way to track this incident as things stand?
Thanks in advance,
Theo
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Theo