Win 2000 Server-how to track who has deleted file

[Pav4o]

Hi there!
Yesterday somebody has deleted file and i want to know who is that?
I have backup and it is no problem to restore the file,but i ask you are there any mechanism to track such things?

 

[ReddLefty]

You can turn on the auditing on your files, but it will generate alot of log entries that will make it almost impossible for you to sort it out. If you only want to track a certain folder, it may be easier. In the security tab of the properties of your folder, click on Advanced, then Auditing. It will only work on NTFS partitions.

There are 3rd party softwares that exist to track these things, but get your wallet out..... Hopefully, someone knows of a free one or close cause I had never found any that didn't go into the 5 digits: xx,xxx$




"In space, nobody can hear you click..."

 

[BWilson77080]

you need to enable auditing in a GPO as well as configure it on the folder itself, audit object access, successful....the only things that will record in the audit log (on your domain controller) is the folders you have set audting for