how to know who delete files from files server

MASWORLD used Ask the Experts™
i have windows server R2 file server
and the file services installed on it
some users delete files i wanna to know who do that i search in event viewer audit but there's many audits how can i find that
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
It will be in the Security log, provided that auditing has been set up and enabled for the directory in question. Auditing file access is resource intensive, and it is usually left disabled.

Until you have set up auditing, you will not see anything.

Here are some basic instructions.
You first will need to turn on auditing, from either local policies, or domain policies and apply it to the machine you want to audit. Once the policy is set you need to configure auditing on everything you want to audit, and that will start adding events to the event log.
Computer Configuration --> Windows Settings --> Security Settings --> Local Policies --> Audit Policy --> Audit object Access

Once you have enabled auditing for file server, you may see the changes in event viewer. Please refer to this blog

You may also take help from below given earlier discussed threads that might helps you to get this job done:

Auditing on file server:

Deleted files and folders:

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial