Logman - trace delete events ?

[MoshiachNow]

HI,

We have a customer on who's XP machine runs our application.
Looks like he reports unintended folders deletion occasionally.
I want to set up a trace on his XP so that ALL delete/rm events by
all
applications are traced into some log, including
timestamp,PID,Process
name,deleted file name.


Is Logman the right tool for this ?
If yes,what would be the way to trace dlete events only ?


Thanks

 

[Poprivet]

HI,

We have a customer on who's XP machine runs our application.
Looks like he reports unintended folders deletion occasionally.
I want to set up a trace on his XP so that ALL delete/rm events by
all
applications are traced into some log, including
timestamp,PID,Process
name,deleted file name.


Is Logman the right tool for this ?
If yes,what would be the way to trace dlete events only ?


Thanks

I don't know Logman, but I do know you can set audits to record those
actions in the local group policies.

 

[MoshiachNow]

I don't know Logman, but I do know you can set audits to record those

actions in the local group policies.- Hide quoted text -

- Show quoted text -

Thanks,

Where I can lookup the info on this issue ?