2003 Server User Auditing

[nekrum]

Hello All

Does anyone know the best way to audit what files / folders delete by who did it and when.

Got phantom file deletions!....

Thanks

[_DeeJay_]

restrospecively - it's going to be difficult.
You can setup auditing on the files for next time though (once you've restored from backup!)

[nekrum]

_DeeJay_ said:

restrospecively - it's going to be difficult. You can setup auditing on the files for next time though (once you've restored from backup!)

What's the best method to do this?

[_DeeJay_]

nekrum said:

_DeeJay_ said: restrospecively - it's going to be difficult. You can setup auditing on the files for next time though (once you've restored from backup!) What's the best method to do this?

You can determine which files are audited using NTFS auditing.

Basically, you:

1) enable auditing (which is the done using policies)
2) Select which files/folders you want to audit and for what actions (right click on the folder, properties, security, auditing)

D