Deleted FIles

[Guest KDawg44]

Hello,

 

I had a user delete a bunch of files from a share. I was able to

recover them but would like to know what user did this. Is there a

way to find this out? It does not appear any auditing was turned on

on the server. Also, how can I just turn auditing on only for

permission changes to folders?

 

Thanks.

 

Kevin

[Guest Meinolf Weber]

Re: Deleted FIles

 

Hello KDawg44,

 

On the folder open security and go to advanced, auditing tab, here you can

add the user/group you want to audit and also you configure the option to

you like to control. The enable "Audit object access" on a GPO linked to

the machine where the share is located.

 

Best regards

 

Meinolf Weber

Disclaimer: This posting is provided "AS IS" with no warranties, and confers

no rights.

** Please do NOT email, only reply to Newsgroups

** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

 

> Hello,

>

> I had a user delete a bunch of files from a share. I was able to

> recover them but would like to know what user did this. Is there a

> way to find this out? It does not appear any auditing was turned on

> on the server. Also, how can I just turn auditing on only for

> permission changes to folders?

>

> Thanks.

>

> Kevin

>