Guest KDawg44 Posted October 30, 2008 Posted October 30, 2008 Hello, I had a user delete a bunch of files from a share. I was able to recover them but would like to know what user did this. Is there a way to find this out? It does not appear any auditing was turned on on the server. Also, how can I just turn auditing on only for permission changes to folders? Thanks. Kevin
Guest Meinolf Weber Posted October 30, 2008 Posted October 30, 2008 Re: Deleted FIles Hello KDawg44, On the folder open security and go to advanced, auditing tab, here you can add the user/group you want to audit and also you configure the option to you like to control. The enable "Audit object access" on a GPO linked to the machine where the share is located. Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. ** Please do NOT email, only reply to Newsgroups ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > Hello, > > I had a user delete a bunch of files from a share. I was able to > recover them but would like to know what user did this. Is there a > way to find this out? It does not appear any auditing was turned on > on the server. Also, how can I just turn auditing on only for > permission changes to folders? > > Thanks. > > Kevin >
Recommended Posts