File deletion logs?

[Guest Mervin Williams]

Does Windows Server 2003 keep a log of all deleted files and the users that

deleted them? I'm running Windows Small Business Server Premium 2003. We

have employees who have just recently left the company, but prior to leaving

they deleted several shared files from the server.

[Guest Lanwench [MVP - Exchange]]

Re: File deletion logs?

 

Mervin Williams <mwilliams@innovasolutions.net> wrote:

> Does Windows Server 2003 keep a log of all deleted files and the

> users that deleted them? I'm running Windows Small Business Server

> Premium 2003. We have employees who have just recently left the

> company, but prior to leaving they deleted several shared files from

> the server.

 

No, but if you've got VSS (volume shadow copy) enabled you can probably 'go

back in time' to view snapshots of the folders which were taken before they

left, if there's stuff missing. Or, you could restore from backup (you do

nightly full backups, one imagines).

 

You'd have had to have very very very granular auditing enabled on the

server *prior* to their doing this, in order to capture it in the event

logs - but it'd be a nightmare trying to read through them.

 

Note that SBS questions are best posted in m.p.windows.server.sbs - it does

a lot of things its own way & you'll get a lot of help in there.

[Guest Todd Richards]

Re: File deletion logs?

 

Setup auditing of the folder(s) in question, then use Security Event Viewer

and look for Event ID's 560.

 

"Mervin Williams" <mwilliams@innovasolutions.net> wrote in message

news:uCYbqVHVIHA.5984@TK2MSFTNGP06.phx.gbl...

> Does Windows Server 2003 keep a log of all deleted files and the users

> that deleted them? I'm running Windows Small Business Server Premium

> 2003. We have employees who have just recently left the company, but

> prior to leaving they deleted several shared files from the server.

>