how to know who delete files from files server
i have windows server R2 file server
and the file services installed on it
some users delete files i wanna to know who do that i search in event viewer audit but there's many audits how can i find that
and the file services installed on it
some users delete files i wanna to know who do that i search in event viewer audit but there's many audits how can i find that
Do more with
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
It will be in the Security log, provided that auditing has been set up and enabled for the directory in question. Auditing file access is resource intensive, and it is usually left disabled.
Until you have set up auditing, you will not see anything.
Here are some basic instructions.
https://gallery.technet.microsoft.com/How-to-enable-File-and-af674be4
Until you have set up auditing, you will not see anything.
Here are some basic instructions.
https://gallery.technet.microsoft.com/How-to-enable-File-and-af674be4
You first will need to turn on auditing, from either local policies, or domain policies and apply it to the machine you want to audit. Once the policy is set you need to configure auditing on everything you want to audit, and that will start adding events to the event log.
GPEDIT:
Computer Configuration --> Windows Settings --> Security Settings --> Local Policies --> Audit Policy --> Audit object Access
Once you have enabled auditing for file server, you may see the changes in event viewer. Please refer to this blog
You may also take help from below given earlier discussed threads that might helps you to get this job done:
Auditing on file server: https://social.technet.microsoft.com/Forums/windowsserver/en-US/da689e43-d51d-4005-bc48-26d3c387e859/auditing-on-file-server?forum=winserverfiles
Deleted files and folders: https://social.technet.microsoft.com/Forums/windowsserver/en-US/dd0f78d0-e39c-4ea6-9087-9250694b9a90/deleted-files-and-folders?forum=winservergen
GPEDIT:
Computer Configuration --> Windows Settings --> Security Settings --> Local Policies --> Audit Policy --> Audit object Access
Once you have enabled auditing for file server, you may see the changes in event viewer. Please refer to this blog
You may also take help from below given earlier discussed threads that might helps you to get this job done:
Auditing on file server: https://social.technet.microsoft.com/Forums/windowsserver/en-US/da689e43-d51d-4005-bc48-26d3c387e859/auditing-on-file-server?forum=winserverfiles
Deleted files and folders: https://social.technet.microsoft.com/Forums/windowsserver/en-US/dd0f78d0-e39c-4ea6-9087-9250694b9a90/deleted-files-and-folders?forum=winservergen
Premium Content
You need an Expert Office subscription to comment.Start Free Trial