[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 874
  • Last Modified:

window server 2012 and 2008

Dear all

We need help actually some user login to server and deleted some file and folder  so we need solution
i want to catch a thief so I request u that how to monitor this task by event viewer in server 2008 && 2012
0
prana1984
Asked:
prana1984
1 Solution
 
pjamCommented:
I have found that when someone says a folder has been deleted, it has really been dragged and dropped by an errant Mouse.  Did you do a search for missing folder?
Setting up auditing to determine who deleted a file is very obnoxious, but can be accomplished if you want that.
See this doc for starters:
http://technet.microsoft.com/en-us/library/cc731607%28v=WS.10%29.aspx

Do you have Shadow Copy running on that Share?  It may tell you when it was deleted.
0
 
nick2253Commented:
You can't--unless you have some kind of auditing enabled.

Windows has built-in auditing: http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access

However, it's not the most user-friendly solution.  If you want more reliable auditing, some third party programs will also email you daily reports and updates based on your settings:

http://www.poweradmin.com/file-sight/
http://www.netwrix.com/file_server_reporting.html
0
 
prana1984Author Commented:
THX All
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now