data was deleted by a user, find who.

Hi all,
Is any way I can find out who deleted a folder ( data) on the server 2008.
We already gave access to every one, through a security group (read modify) and some one deleted  data .

Please let me know if there is a command line to run in active directory, on in AD.



Thanks
Rabih
RabihhajAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
David Johnson, CD, MVPConnect With a Mentor OwnerCommented:
windows maintains many event logs, the most familiar are
application
security   <<<------
system

if on right clicks on a folder, security settings, advanced, this will show the audit settings
What you are interested in is event 560 in the security event logs.
sample picture
good information: http://sogeeky.blogspot.ca/2006/07/how-to-audit-and-track-file-deletions.html
0
 
David Johnson, CD, MVPOwnerCommented:
the security logs will tell you.. you did enable auditing didn't you?
0
 
RabihhajAuthor Commented:
Hi Vi3ofa,

where is the logs is stored?. and how do i check if it is enable auditing.

Please provide me with the instruction if possible.

Thanks
Rabihhaj
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.