Question : Deleted Files, Who & When, Server 2008, NAS

Hi guys,

We have a network drive that is delegated security permissions through Windows 2008 servers. Let's just say somebody deleted a certain file from the drive (that they had access to), is there a way to track down who deleted the file and when it was deleted?

Answer : Deleted Files, Who & When, Server 2008, NAS

Right click on the folder where the data is stored, click properties, click the Security tab, then advanced, then the auditing tab. Click Edit, then Add. Enter Everyone and hit enter. A box will come up asking for what type of auditing you want to do. Scroll down to "Delete Subfolders and Files" and "Delete" and check Successful and Failed on each. Hit okay all the way back out. Entries will show up in the Security log on the Server or Computer that holds that folder. Let me look up the security codes on those so I can give you a way to filter for it.
Random Solutions  
 
programming4us programming4us