monitor file deletion

[Guest]

we have a windows 2000 advnaced server with shared drives on it, some times
the files get deleted from it, i need to know the following details of these
deletions.

windows logon name
Pc name or IP address
date and time of deletion.
also is there a way to trigger the administrator by email whenever these
deletions happen on these shared drives?

 

[Dave Patrick]

Look into file and folder auditing.

http://www.microsoft.com/technet/prodtechnol/windows2000serv/deploy/confeat/13w2kadc.mspx

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| we have a windows 2000 advnaced server with shared drives on it, some
times
| the files get deleted from it, i need to know the following details of
these
| deletions.
|
| windows logon name
| Pc name or IP address
| date and time of deletion.
| also is there a way to trigger the administrator by email whenever these
| deletions happen on these shared drives?
|

 

[Guest]

thanks. But the event log gets full in this case. also i want some kind of
notification like email as soon as the file is deleted. how do we get email
notification

 

[Pegasus \(MVP\)]

You could use the Task Scheduler to run dumpel.exe once
every five minutes, examine the contents of its output file
with find.exe, then use a Command Line mailer to inform
you of any file deletions.

dumpel.exe comes with the Windows Resource Kit.
Command Line mailers such as blat.exe, mailto.exe or
sendmail.exe are freely downloadable from various sites.

thanks. But the event log gets full in this case. also i want some kind of
notification like email as soon as the file is deleted. how do we get email
notification

Look into file and folder auditing.

http://www.microsoft.com/technet/prodtechnol/windows2000serv/deploy/confeat/13w2kadc.mspx

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| we have a windows 2000 advnaced server with shared drives on it, some
times
| the files get deleted from it, i need to know the following details of
these
| deletions.
|
| windows logon name
| Pc name or IP address
| date and time of deletion.
| also is there a way to trigger the administrator by email whenever these
| deletions happen on these shared drives?
|

 

[Guest]

thanks. Again will running task scheduler every 5 minutes and turning
auditing on will not eat system resoruces. also will this auditing give all
these detalis about the user who deleted the file like IP address of the
machine, windows logon name , PC name etc.

I have clients across WAN also.

You could use the Task Scheduler to run dumpel.exe once
every five minutes, examine the contents of its output file
with find.exe, then use a Command Line mailer to inform
you of any file deletions.

dumpel.exe comes with the Windows Resource Kit.
Command Line mailers such as blat.exe, mailto.exe or
sendmail.exe are freely downloadable from various sites.

thanks. But the event log gets full in this case. also i want some kind of
notification like email as soon as the file is deleted. how do we get email
notification

Look into file and folder auditing.

http://www.microsoft.com/technet/prodtechnol/windows2000serv/deploy/confeat/13w2kadc.mspx

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| we have a windows 2000 advnaced server with shared drives on it, some
times
| the files get deleted from it, i need to know the following details of
these
| deletions.
|
| windows logon name
| Pc name or IP address
| date and time of deletion.
| also is there a way to trigger the administrator by email whenever these
| deletions happen on these shared drives?
|