Tracking User who delted files????

[NewMan]

I have a Win2000 Server running Active DIrectory. I have a situation
where I KNOW that some files were deleted. I cannot prove if they were
deleted by accident or maliciously, but I have my suspiciions. I CAN
narrow the possibilities because the files were in a Security
Restricted area. So.....

Is there any logs, etc, that can tell me explicitly which AD User
deleted a specific file?

Thanks in advance.

 

[Meinolf Weber]

Hello NewMan,

Only if you have enabled Auditing on the folder where the files are located.
Auditing you can enable on the folder with the security>advanced>auditing
tab.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.dts-l.org/goodpost.htm

 

[NewMan]

Oh well...

Question: If you enable Auditing on a folder, does the Auditing also
get enabled for all sub-folders contained by that folder?

Thanks.

 

[Ace Fekay [MVP]]

In

Oh well...

Question: If you enable Auditing on a folder, does the Auditing also
get enabled for all sub-folders contained by that folder?

Thanks.

If I may jump in, I believe so because of inheritance. You can go into the
folder's properties, and uncheck inheritance, but that will also stop
security ACL inheritance, where if you do not want to do that, you can go
into the Security Tab, advanced, Auditing tab, and disable iton a per folder
or file basis.

Ace