Any way to find out who is deleting files/folders off of a shared network drive?

Auditing is currently NOT turned on.  This is a Windows 2003 file server with THOUSANDS of sub directories...I thought if I turned on auditing for the entire volume, it would be too much overhead, but in the past couple months we've had two two directories "disappear" and no way to track what happened to them.  I was able to restore from backup, but now I want to find out what's going on.  Suggestions?
tenoverAsked:
Who is Participating?
 
Kennyboy5IT Support AnalystCommented:
You would have to setup auditing on the server. On the file server go to the folder in question, right click, properties, Security tab, Advanced, Audit

Here's a detailed article.

http://support.microsoft.com/kb/325898
0
 
Kennyboy5IT Support AnalystCommented:
You could turn on just 'delete' for the audit which would cut down on a lot of entries in the event viewer.
0
 
MPontoNetwrok AdminCommented:
Turn on auditing only for successful deletion of the folder object.
when you init auditing for the root of the share add everyone, remove inherit from parent and select only the delete option.
if a folder turns up missing with empty logs you will know it simply got moved.

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.