Tracking User who delted files????

  • Thread starter Thread starter NewMan
  • Start date Start date
N

NewMan

I have a Win2000 Server running Active DIrectory. I have a situation
where I KNOW that some files were deleted. I cannot prove if they were
deleted by accident or maliciously, but I have my suspiciions. I CAN
narrow the possibilities because the files were in a Security
Restricted area. So.....

Is there any logs, etc, that can tell me explicitly which AD User
deleted a specific file?

Thanks in advance.
 
Hello NewMan,

Only if you have enabled Auditing on the folder where the files are located.
Auditing you can enable on the folder with the security>advanced>auditing
tab.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.dts-l.org/goodpost.htm
 
Oh well...

Question: If you enable Auditing on a folder, does the Auditing also
get enabled for all sub-folders contained by that folder?

Thanks.
 
In
NewMan said:
Oh well...

Question: If you enable Auditing on a folder, does the Auditing also
get enabled for all sub-folders contained by that folder?

Thanks.
Click to expand...

If I may jump in, I believe so because of inheritance. You can go into the
folder's properties, and uncheck inheritance, but that will also stop
security ACL inheritance, where if you do not want to do that, you can go
into the Security Tab, advanced, Auditing tab, and disable iton a per folder
or file basis.

Ace
 
Back
Top