Audit for file/folder deletion

[Aaron]

Hi everyone

 

i was wondering if anyone had setup auditing on a server to find out who has delete a file/folder and could shed some light on if i have gone wrong:

 

I setup the local security setting:

 

local policies - audit policy- aduit object access - Success

 

I have also set on the folder:

 

Properties - security - advanced - auditing - added groups/users - type (success) - this folder, subfolders and files - permissions (delete subfolders and files, delete) & replace all child object auditing entries with inheritable auditing entries from this object.

 

 

Straight away my event viewer, security logs have started showing allot of events (Mainly ID 5145 detailed file share) and if i try to say no auditing for this all events seem to stop. I am only interested in the success logs for a file/folder deletion and was wondering have i done something wrong that anyone can see. I have been adding files and deleting under my own account which is also under the folder auditing but its not showing me that i have deleted the file/folder.

 

I am running server 2012 and 2012R2 and from what i could find the logs i should be interested in are 4660, 4663 and 4656 can anyone shed light have i missed a step to get these logs because the ones it seems to be showing me more is that if somone has made an attempt to access an object (not showing me that they have actually deleted the object)

[Aaron]

i have just double checked and the event view is recording IT 4663, 4658 and 4656 but again these logs are only telling me an attempt was made to access the file they dont actually tell me if the file was deleted, i have just checked on a user and the logs are written but the user was only accessing the file not deleting the file.

[Aaron]

I think i have this solved.

 

if a folder is deleted it logs an event with 4660 but i have to compare the handle ID in event 4660 with event 4663 this will tell you what object was deleted. ID 4663 is generated just before ID 4660 so easy to find and compare.

 

if a file is removed it looks like it generates an event ID 4659: object was requested with intent to delete (this one tells you the object name) following on from this id it seems to generate a 4658(handle to an object was closed) then 4656(handle to object was requested) and 4658(handle to an object was closed) again.

 

event ID 4659 is only generated when the file is deleted tried this a few times by clicking delete and then selecting NO this only generates the 4658, 4656 and 4658 again. but as soon as you click delete and click yes the event log generates the 4659 followed by 4658, 4656, 4658.

 

hopefully this will be of some help to others.

[Aaron]

thought I had this and everything was working great but then noticed this morning that the policy is set to "not configured" and the logs are only collecting 5145 event id