track who accessed/deleted a file/folder.

[Guest]

Does anyone know how to track who last accessed a file or
folder? In Novell, once someone opened the file/folder,
there is a time and user ID stamped. If someone also
deletes a file, you can find out who deleted a file. I
have setup audit in win2k, but it is no use.
Thanks.
Min

 

[Steven L Umbach]

You can enable auditing of object access and then audit specific files/folders for
particular access levels by users/groups, but it does generate a huge amount of
entries so you may want to use it sparingly. It may help to filter for certain for
events such as 560 and 562. --- Steve

 

[Karl Levinson [x y] mvp]

Auditing files is a two step process. Make sure you have enabled both steps
and are checking in the correct log:

http://securityadmin.info/faq.htm#auditing

 

[Guest]

Hi,
Unfortunately I have did all that, and also asked someone
to test it as well. It just doesn't work. Have anyone
of you tested this yet?
Thanks,
Min