Server 2012 R2 File Share Auditing
Is there a way to audit file shares to see what user deleted certain directories and/or files?
Mohammed Khawaja
You can do it if you enable file and object auditing. One word of caution though, logs can get very big.
ASKER
Can you please tell me exactly which ones to enable? And where they are?
Open Administrative Tools > Local Security Policy.
Expand Local Policies and click Audit Policy in the left pane.
Select Audit object access in the right pane, and then click Action > Properties.
Select Success and Failure.
Click OK.
Close the Local Security Policy window.
Expand Local Policies and click Audit Policy in the left pane.
Select Audit object access in the right pane, and then click Action > Properties.
Select Success and Failure.
Click OK.
Close the Local Security Policy window.
ASKER
Here is a screenshot of what I see...... Which ones do I enable?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Detailed fileshare, fileshare, file system set to success and failure
I secon Curt's suggestion.