Can I find out who deleted files from a shared folder?

[dfinan]

Hi Guys,

 

As above... I need to identify a student who has deleted some files from a shared folder, is there a way I can identify who last made changes to the folder?

 

Many thanks.

[elsiegee40]

It is unlikely unless you have tracking tools in place or have logging switched on. Do you have volume shadow copy on this drive? It has saved my bacon a few times on shared drives.

[dfinan]

It is unlikely unless you have tracking tools in place or have logging switched on. Do you have volume shadow copy on this drive? It has saved my bacon a few times on shared drives.

 

Ah, that's what I was afraid of. Yeah I have a copy, it's all safe but just really would like to find the culprit! I can only identify the time/date of when it was deleted, just not the user.

[Tall_Paul]

You can't do it retrospectively but you can turn on folder auditing for the future.

 

See here for Server 2008 example.