Server 2008 R2 File System Audit Logging Not Showing File or Folder Names

Posted on 2012-08-30
Last Modified: 2012-09-04
I have successfully enabled the audit logging of my files shares to Everyone, and see the events in the Security log, and see Event 4660 being generated with the account name of who deleted, however it doesn't show what file/folder was deleted, I don't see this generated in any of the events or logs?
Question by:fireguy1125
    LVL 12

    Expert Comment

    Event logs information is limited and generally does not show detailed one. You need to have to have a third party solution to do a proper filtering. It helps, please check the link below.
    LVL 1

    Accepted Solution

    I actually found it was a few events prior to the 4660 and is actually under 4656: A handle to an object was requested and 4663: An attempt was made to access an object.

    Had to scroll down in the window to reveal:

    Access Request Information:
    Accesses: DELETE
    LVL 1

    Author Closing Comment

    Resolved on own.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Want to promote your upcoming event?

    Is your company attending an event or exhibiting at a trade show soon? Are you speaking at a conference? Spread the word by using a promotional banner in your email signature. This will ensure your organization’s most important contacts are in the know.

    Recently, I was asked to look into SCCM 2007 by my employer, having a degree of experience of earlier versions of SMS and some previous SCCM knowledge I didn't expect the procedure to involve to much time. I read a number of guides concerning it…
    You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
    This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now