File/Folder deleting and moving

[Stumpy]

Hello

 

Can anyone help , I have searched and not found to much info on being able to monitor who has deleted or moved a file/folder on a shared drive on our network. We are using server 2003. Anyone know how to find out this information or any software that we could install ?

[srochford]

Turn on auditing on the filesystem for the folder above the one which is being moved (eg if on the server you have d:\groups\maths, d:\groups\science etc then I think you want to monitor d:\groups). You also need to turn on auditing in the local security settings of the server.

 

When you do this, an event will be written to the security event log of the server but if this is a busy server you could be swamped in data.

[Stumpy]

Thanks It is a busy server, I have set up the audit for the folder that i wanted to monitor when i log into event viewer though it does not really tell me what has been moved or deleted just that it has been accessed. any ideas ?

[srochford]

When you turn on auditing on the file system you will get a *lot* of info; I think you're looking for event 562 for delete (see sample below from my event log) and you can filter on this.

 

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 07/07/2008

Time: 17:15:17

User: CISNT\1973

Computer: PC051208

Description:

Object Open:

Object Server: Security

Object Type: File

Object Name: C:\temp\trans\Translator.sa.CAB

Handle ID: 3576

Operation ID: {0,12812947}

Process ID: 2788

Image File Name: C:\WINDOWS\explorer.exe

Primary User Name: 1973

Primary Domain: CISNT

Primary Logon ID: (0x0,0x6C227)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: DELETE

ReadAttributes

 

Privileges: -

Restricted Sid Count: 0

 

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.