Event ID for unsharing folder

Hi,

I am investigating a issue of folder sharing. One of the folders in the server was shared and suddenly this shared folder was inaccessible. Checking the server it was found that the folder sharing was removed. Could you please help me to find out the exact event id so that can figure out who has unshared this folder.
Saravanakumar SAsked:
Who is Participating?
 
McKnifeConnect With a Mentor Commented:
Sharing/unsharing changes the registry. Unless you access-audited the registry locations where shares are listed, there will be no event log entry. So check whether there are auditing settings applied to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
0
 
Saravanakumar SAuthor Commented:
You mean auditing should be enabled to the particular registry folder or to the folder which is being shared. Please let me know.
0
 
McKnifeConnect With a Mentor Commented:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares needs to be audited including all subkeys (inheritance). That way, new shares will be audited, too, you will see changes no matter what is shared/unshared.
0
 
Saravanakumar SAuthor Commented:
I've requested that this question be closed as follows:

Accepted answer: 0 points for Saravanakumar S's comment #a40537455

for the following reason:

Thanks
0
 
McKnifeCommented:
Thanks? What should that mean? Don't close a question without an explanation.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.