How to find out who deleted a particular file
If you want to know who deleted a particular file in Windows 2003 all you need to do is enable auditing the folder you want to keep track of. Just right click on the folder, go to “sharing and security”, then “security” tab, at the bottom click on “advanced”. Select the auditing tab, click add, select the group or users to track, then pick what actions you want to track.
To track file deletion you would enable:
Create files/Write data Success/Fail
Create folders / append data Success/Fail
Delete Subfolders/Files Success/Fail
Delete Suceess/Fail
Once thats done Windows will log all the information in the security event log.
- Suramya
No its me allright. I was told very specifically not to open up the laptop as that would void the...
Wait…a…second…
So you are actually talking about a “good” feature of windows?!
Wow!
Comment by Vinit — October 22, 2007 @ 2:24 am
Hey… I am not that anti-windows. Windows has its good points, its just that most of them are not usually relevant to what I want/need. As I have said earlier people should use what works for them. If Windows has its good points I mention them. However I also mention the bad points.
If you think I have been posting a lot more about windows than Linux then the reason is simple: I have been using Windows more often recently (due to work) than Linux so I have hit a lot more issues that annoy me in Windows.
Whatever happened to the MyRoomMate’s OS idea we talked about a few years ago? You still want to take a shot at it?
- Suramya
Comment by Suramya — October 25, 2007 @ 12:38 pm