Re: Deleted Files -Help!

From: Steven Umbach (n9rou_at_n0spam-comcast.net)
Date: 04/27/04 

Date: Tue, 27 Apr 2004 01:22:10 GMT

You would first need to enable auditing of object access on a computer and then
configure auditing on specific folder/files. Be sure to only audit for deletion
to keep number of events down as you can end up with a tremendous amount of
events in the security log in Event Viewer. Don't try to audit everything - just
what is needed. See the link below for more info and try it out on a test
computer so you can see all is entailed. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
http://www.microsoft.com/technet/security/guidance/secmod144.mspx

"Michael" <anonymous@discussions.microsoft.com> wrote in message
news:13E5BAD5-1A36-4764-B303-33C69B99E0DB@microsoft.com...
> I came in this morning to discover that MANY files had been deleted over the
weekend. Is there any way to find out who deleted them, and is there a way to
track files deletions in the Event Viewer in the future?

Relevant Pages

  • Re: Security Breach in AD W/2000 Server
    ... I have used event viewer many times, I was just unable to locate the event ... triggered by the audit. ... I have now configured Restricted Groups and I really hope that helps. ... "Laura E. Hunter " wrote: ...
    (microsoft.public.win2000.active_directory)
  • Re: Monitor Computer/File Access
    ... You can enable auditing on your computer and then look at the security log ... in Event Viewer to see who has been logging onto or accessing your computer ... over the network assuming you are a local administrator. ... IPC then any user with read access to those shares can copy files from that ...
    (microsoft.public.win2000.security)
  • Re: Domain Security Policy
    ... All security audit events end up in the "Security Log" in event viewer. ... For auditing account adds/deletes...audit "Account Management" events. ...
    (microsoft.public.win2000.advanced_server)
  • Re: logging individual users on a network
    ... >You can see this information in the Event Viewer ... Open the Audit Policy branch and choose the Audit Account ... >Per user Group Policy Restrictions for XP Home and XP Pro ...
    (microsoft.public.windowsxp.customize)
  • Re: logging individual users on a network
    ... You can see this information in the Event Viewer ... To choose which events to audit, go to Start, Run and enter SECPOL.MSC Open the Audit Policy branch and choose the Audit Account logon events. ... Per user Group Policy Restrictions for XP Home and XP Pro ...
    (microsoft.public.windowsxp.customize)