Which event ID do I trap for file / folder deletions in Windows 2008 (not R2)
Posted on 2013-12-13
I need to trap for when a file or folder is deleted on a Windows 2008 server (not R2).
I turned on auditing for file and folder deletions. I started to trap on event id 4663, but 4663 is also used for renaming and saving the file. The events for a rename and deletion are the same, so I can't use this for a trap.
I need an event id that is only used for a file / folder deletion so I can trap it for an alert.