Server 2003 - track deleted files

Is there someway to track which user/s are deleting files on a server 2003
files server?

We regularly have files been deleted and would like to track who the
culrpits are to deal with them.

 

Hello Gerald,

You have to enable file/folder auditing, see this from another posting:
-------------------------------------------------------------------------------------------
Enabling file auditing is a 2-step process.

[1] Configure "audit object access" in AD Group Policy or on the server's
local GPO. This setting is located under Computer Configuration-->Windows
Settings-->Security Settings-->Local Policies-->Audit Policies. Enable success/failure
auditing for "Audit object access."

[2] Configure an audit entry on the specific folder(s) that you wish to audit.
Right-click on the folder-->Properties-->Advanced. From the Auditing tab,
click Add, then enter the users/groups whom you wish to audit and what actions
you wish to audit - auditing Full Control will create an audit entry every
time anyone opens/changes/closes/deletes a file, or you can just audit for
Delete operations.

After you've done both of these steps, any file deletions will show up in
the Security log of the file server that hosts those files.

HTH
-------------------------------------------------------------------------------------------

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Is there someway to track which user/s are deleting files on a server
> 2003 files server?
>
> We regularly have files been deleted and would like to track who the
> culrpits are to deal with them.
>

 

Hi Meinolf,

Does this cause extra noticeable overhead to the server?

Thanks,

Phil

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
news:ff16fb66214db8cb972bca8815ed@msnews.microsoft.com...
> Hello Gerald,
>
> You have to enable file/folder auditing, see this from another posting:
> -------------------------------------------------------------------------------------------
> Enabling file auditing is a 2-step process.
>
> [1] Configure "audit object access" in AD Group Policy or on the server's
> local GPO. This setting is located under Computer Configuration-->Windows
> Settings-->Security Settings-->Local Policies-->Audit Policies. Enable
> success/failure auditing for "Audit object access."
>
> [2] Configure an audit entry on the specific folder(s) that you wish to
> audit. Right-click on the folder-->Properties-->Advanced. From the
> Auditing tab, click Add, then enter the users/groups whom you wish to
> audit and what actions you wish to audit - auditing Full Control will
> create an audit entry every time anyone opens/changes/closes/deletes a
> file, or you can just audit for Delete operations.
>
> After you've done both of these steps, any file deletions will show up in
> the Security log of the file server that hosts those files.
>
> HTH
> -------------------------------------------------------------------------------------------
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Is there someway to track which user/s are deleting files on a server
>> 2003 files server?
>>
>> We regularly have files been deleted and would like to track who the
>> culrpits are to deal with them.
>>
>
>

 

Hello Phil,

Ofcourse there will be more load/traffic on the server, it is additional
work.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi Meinolf,
>
> Does this cause extra noticeable overhead to the server?
>
> Thanks,
>
> Phil
>
> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
> news:ff16fb66214db8cb972bca8815ed@msnews.microsoft.com...
>
>> Hello Gerald,
>>
>> You have to enable file/folder auditing, see this from another
>> posting:
>> ---------------------------------------------------------------------
>> ---------------------- Enabling file auditing is a 2-step process.
>>
>> [1] Configure "audit object access" in AD Group Policy or on the
>> server's local GPO. This setting is located under Computer
>> Configuration-->Windows Settings-->Security Settings-->Local
>> Policies-->Audit Policies. Enable success/failure auditing for "Audit
>> object access."
>>
>> [2] Configure an audit entry on the specific folder(s) that you wish
>> to audit. Right-click on the folder-->Properties-->Advanced. From the
>> Auditing tab, click Add, then enter the users/groups whom you wish to
>> audit and what actions you wish to audit - auditing Full Control will
>> create an audit entry every time anyone opens/changes/closes/deletes
>> a file, or you can just audit for Delete operations.
>>
>> After you've done both of these steps, any file deletions will show
>> up in the Security log of the file server that hosts those files.
>>
>> HTH
>> ---------------------------------------------------------------------
>> ----------------------
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> Is there someway to track which user/s are deleting files on a
>>> server 2003 files server?
>>>
>>> We regularly have files been deleted and would like to track who the
>>> culrpits are to deal with them.
>>>