Anyway to determine who "deleted" file/shortcut ? 1

[pctekkk]

is there any logfile/temp file windows xp might keep to determine when/who deleted a file, actually a shorcut and .dbf files on a pc ??

there are several who login, so we havent determine who did it. my tech restored the files from the recycle bin
before checking any details.

i told him to turn on auditing of files for now, but any help in the meantime ??

Thanks gang !

 

[linney]

To delete any file the permissions to allow full control must apply. What do the security permissions on the file tell you for each user?

 

[pctekkk]

looks like each user has full permissions in security
C**p


how do u turn on local auditing for files for all users sharing that pc ?

thanks Linney

 

[linney]

Have a look at Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

This will give you a list of Audit options. What you are asking for may be too much for XP and require some third party software. You can at least see who is logged on at a given time.

 

[pctekkk]

thanks !

appreciate it !