How to find out who deleted what

[Chrish5]

Is there anyway to find out who deleted (or even modified) a file from a network share? (Windows Server 2003)

[elsiegee40]

Do you have volume shadow copy? That will help you to establish a short time frame when the file was deleted and may help to identify the culprit.

[Chrish5]

Nope

 

(needed a few extra chars to post so here's some)

[OutToLunch]

After the deletion and before the planning on what to do about deleted files? No. You'd need file auditing turned on before the file was deleted, not after - but setting it up may help you in future situations.

[Chrish5]

Yeah thought auditing would be necessary, will turning it on slow things down at all/much?

 

Just had a look at it now, do I just add the Network Shares to the list of audited 'files' on the group policy for the dc(s)?

And is it in Event Viewer where I'd find details of what's gone on then?

Edited October 16, 2008 by Chrish5

[mikeymike]

not sure if it works if modified but when someone puts a file somewhere you can track it back to who the owner is. dont know if this helps?

[MPorter]

Yeah thought auditing would be necessary, will turning it on slow things down at all/much?

 

Just had a look at it now, do I just add the Network Shares to the list of audited 'files' on the group policy for the dc(s)?

And is it in Event Viewer where I'd find details of what's gone on then?

 

Hi Chris

 

To set up auditing, modify the group policy affecting the server containing the files. You need to navigate to Computer Config, Windows Settings, Security Settings, Local Polices, Audit Policy, and set the "Audit Object Access" setting to audit for Success and/or Failure.

 

Then, navigate the folder that you wish to audit, bring up its properties, then security. Click on "Advanced", and then the auditing tab. From here, you can add users or groups to audit for this folder, and define what actions to audit, E.g. Delete, Delete Sub Folders and Files, Modify Etc.

 

Any collected data will appear in Event Viewer, under security.

 

Hope this helps

 

 

Maria

[Chrish5]

Cheers for that - I did some of that before I left this evening - I'll follow what you said tomorrow.

 

And to all those concerned don't worry I didn't lose anything important as the backups were fine. Just wanted to sort this out for the future so I know which teacher to shout at/ridicule.

Edited October 16, 2008 by Chrish5

[Michael]

Be very careful when enabling auditing. If you specify too much, the event logs will get full very quickly.

 

Auditing is only good if you can spend the time looking through hundreds of logs.

[srochford]

It can generate lots of data - you will certainly want to increase the size of log allowed.

 

You then need to look at some of the tools available for monitoring logs and helping you to find useful info.

 

Microsoft have a couple which can help - logparser and eventcomb (this is a resource kit tool; it does lots of stuff but can be helpful)