Logging deletion of files in Windows 2000?

  • Thread starter Thread starter Bill Rubin
  • Start date Start date
B

Bill Rubin

How can I get Windows 2000 to log when files are deleted? I
found Administrative Tools -> Local Security Policy -> Local
Policies -> Audit Policy, which has "Audit object access" which
seems like it's what I want, but I can't figure out what it does
and how it works. What would I do to get it to log when a file
was deleted, and hopefully by who/what? And how do I access the
log once it's created?

Thanks..
Bill
 
Take a look at 3rd party software to accomplish this.
http://www.outpost.com/product/3624255

I do not know of any built in Windows 2000 file deletion logging function

Pete Choppin, MCP

----- Bill Rubin wrote: -----

How can I get Windows 2000 to log when files are deleted? I
found Administrative Tools -> Local Security Policy -> Local
Policies -> Audit Policy, which has "Audit object access" which
seems like it's what I want, but I can't figure out what it does
and how it works. What would I do to get it to log when a file
was deleted, and hopefully by who/what? And how do I access the
log once it's created?

Thanks..
Bill
 
Bill said:
How can I get Windows 2000 to log when files are deleted? I
found Administrative Tools -> Local Security Policy -> Local
Policies -> Audit Policy, which has "Audit object access" which
seems like it's what I want, but I can't figure out what it does
and how it works. What would I do to get it to log when a file
was deleted, and hopefully by who/what? And how do I access the
log once it's created?
Click to expand...
You need to enable object auditing either in the local security policy for a
standalone machine , or in the group policy of you are in a domain.

Next you need to tell windows exactly which files you want audited , and
what for.

Right click on the folder you want audited and select properties , security
, advanced.
Under auditing you can then add the groups you want to monitor (use everyone
if you want complete monitoring) and what actions you want recorded.

Once this has been done , if anyone in the groups you have selected makes
any changes of the type you have selected to the files you have selcted
<pauses for breath> then an entry will be recorded in the security log on
your machine.

Hope this helps.


--
Alex

"I laugh in the face of danger"

"Then I hide until it goes away"

www.drzoidberg.co.uk
 
Back
Top