Deleted files on shares, no log ?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi guys,

I have a Files Server Win 2000 Server STD with a lot of shares.

Is it possible to know when and wich user have deleted files on a share ?
 
MrHappy pointed you in the write direction. beware however that you will see
LOTS of object access events in the security log. You can minimize such by
auditing only for the two delete permissions. It will also help to use the
free Event Comb from Microsoft to search your security logs for Event IDs
[560 will be very pertinent] and text strings such as delete, or filename.
The links below may be helpful. --- Steve

http://www.microsoft.com/technet/se...andmonitoring/securitymonitoring/default.mspx
http://www.jsifaq.com/SUBR/tip8600/rh8639.htm
 
--
Eric.


Steven L Umbach said:
MrHappy pointed you in the write direction. beware however that you will see
LOTS of object access events in the security log. You can minimize such by
auditing only for the two delete permissions. It will also help to use the
free Event Comb from Microsoft to search your security logs for Event IDs
[560 will be very pertinent] and text strings such as delete, or filename.
The links below may be helpful. --- Steve

http://www.microsoft.com/technet/se...andmonitoring/securitymonitoring/default.mspx
http://www.jsifaq.com/SUBR/tip8600/rh8639.htm

Eric. said:
Hi guys,

I have a Files Server Win 2000 Server STD with a lot of shares.

Is it possible to know when and wich user have deleted files on a share ?
Click to expand...
Click to expand...
 
Back
Top