Deleted files on shares, no log ?

[Guest]

Hi guys,

I have a Files Server Win 2000 Server STD with a lot of shares.

Is it possible to know when and wich user have deleted files on a share ?

 

[Guest]

you can enable auditing on the drive that the share is on.
http://support.microsoft.com/kb/300549/en-us

 

[Steven L Umbach]

MrHappy pointed you in the write direction. beware however that you will see
LOTS of object access events in the security log. You can minimize such by
auditing only for the two delete permissions. It will also help to use the
free Event Comb from Microsoft to search your security logs for Event IDs
[560 will be very pertinent] and text strings such as delete, or filename.
The links below may be helpful. --- Steve

http://www.microsoft.com/technet/se...andmonitoring/securitymonitoring/default.mspx
http://www.jsifaq.com/SUBR/tip8600/rh8639.htm

 

[Guest]

--
Eric.

MrHappy pointed you in the write direction. beware however that you will see
LOTS of object access events in the security log. You can minimize such by
auditing only for the two delete permissions. It will also help to use the
free Event Comb from Microsoft to search your security logs for Event IDs
[560 will be very pertinent] and text strings such as delete, or filename.
The links below may be helpful. --- Steve

http://www.microsoft.com/technet/se...andmonitoring/securitymonitoring/default.mspx
http://www.jsifaq.com/SUBR/tip8600/rh8639.htm

Hi guys,

I have a Files Server Win 2000 Server STD with a lot of shares.

Is it possible to know when and wich user have deleted files on a share ?

 

[Guest]

Thank you very much MrHappy and Steven.
I will try this option in my new FS.