Deleted FIles

[KDawg44]

Hello,

I had a user delete a bunch of files from a share. I was able to
recover them but would like to know what user did this. Is there a
way to find this out? It does not appear any auditing was turned on
on the server. Also, how can I just turn auditing on only for
permission changes to folders?

Thanks.

Kevin

 

[Meinolf Weber]

Re: Deleted FIles

Hello KDawg44,

On the folder open security and go to advanced, auditing tab, here you can
add the user/group you want to audit and also you configure the option to
you like to control. The enable "Audit object access" on a GPO linked to
the machine where the share is located.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hello,
>
> I had a user delete a bunch of files from a share. I was able to
> recover them but would like to know what user did this. Is there a
> way to find this out? It does not appear any auditing was turned on
> on the server. Also, how can I just turn auditing on only for
> permission changes to folders?
>
> Thanks.
>
> Kevin
>