Server 2008 R2 File System Audit Logging Not Showing File or Folder Names

Posted on 2012-08-30
Medium Priority
Last Modified: 2012-09-04
I have successfully enabled the audit logging of my files shares to Everyone, and see the events in the Security log, and see Event 4660 being generated with the account name of who deleted, however it doesn't show what file/folder was deleted, I don't see this generated in any of the events or logs?
Question by:fireguy1125
  • 2
LVL 12

Expert Comment

ID: 38350925
Event logs information is limited and generally does not show detailed one. You need to have to have a third party solution to do a proper filtering. It helps, please check the link below.


Accepted Solution

fireguy1125 earned 0 total points
ID: 38350934
I actually found it was a few events prior to the 4660 and is actually under 4656: A handle to an object was requested and 4663: An attempt was made to access an object.

Had to scroll down in the window to reveal:

Access Request Information:
Accesses: DELETE

Author Closing Comment

ID: 38362889
Resolved on own.

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Suggested Courses

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question