How to track data deletion in a Windows Domain?

How to track data deletion in a Windows Domain? I have a client who is audited regularly. They have 2 Windows 2008 servers functioning as domain controllers for Windows 7 workstations. Is there a way to track and verify data deletion on the servers? Something that can be reported in someway to show that it actually happens? I would imagine there's some overhead to running something like this. I need to create a "Data Destruction Policy". Any thoughts would be greatly appreciated. Most of what I have found has been about full hard drive wiping on a single pc basis.
jsgouldAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
Philip PortnoyConnect With a Mentor Sr. MS SQL DBA and Technical Account ManagerCommented:
You should use backups/shadow copying and other DR/HA solutions to provide restore capabilities.

Auditing tools are for auditing. B&R - for B&R.
0
 
Lee W, MVPConnect With a Mentor Technology and Business Process AdvisorCommented:
Enable File Access Auditing.  That information can then be recovered from the Security log.

If you have TONS of disk space to spare, you use a tool like DriveLock which can basically create copies of files that are deleted and note who deleted them when.  It's not free though.

http://www.drivelock.com/Solutions
0
 
Philip PortnoyConnect With a Mentor Sr. MS SQL DBA and Technical Account ManagerCommented:
You can use File Server auditing, but it's audit logs are pretty hard to read.
One of the best non-freeware solutions is one from Quest: http://www.quest.com/changeauditor-for-windows-file-servers/
0
 
jsgouldAuthor Commented:
Ok. I've reviewed both of these. DriveLock seems a bit too much and the additional space that would be required for that may be to costly.. Quest looks interesting but neither seem to assure of the data deletion portion just monitors what was deleted, moved, renamed. etc. and by whom.
0
 
Lee W, MVPConnect With a Mentor Technology and Business Process AdvisorCommented:
Auditing is the best, included method for doing what you want or close to it.  If you want anymore, it's going to cost you and it's probably not going to be cheap given the market for the products.
0
All Courses

From novice to tech pro — start learning today.