|
Posted by IT Boy on June 15, 2005, 3:06 am
If you were Registered and logged in, you could reply and use other advanced thread options
Hi,
It is possible and how to set Audit so I can log which user at which
workstation delete an file or folder?
Thank,
S.
|
|
Posted by Roger Abell on June 15, 2005, 4:39 am
If you were Registered and logged in, you could reply and use other advanced thread options
You may easily set auditing to record which account deleted
a file or folder. You would need to cross-correlate this account
info with login records to determine from what workstation, and,
you would have to use other means to tie the account use to a user.
To set auditing, in the Auditing policies of the machine where the
file/folder exists, enable the policy setting "Audit object access"
(likely for success and failure). Then, at the filesystem area of
concern access the NTFS Security dialog in the properties of the
folder rooting that NTFS area and click into the Advanced view,
where you would access the Audit tab and define to audit Delete
for Everyone and check to have it applied to all substructure.
--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
> Hi,
>
> It is possible and how to set Audit so I can log which user at which
> workstation delete an file or folder?
>
> Thank,
>
> S.
>
>
|
|
Posted by Karl Levinson, mvp on June 15, 2005, 7:46 am
If you were Registered and logged in, you could reply and use other advanced thread options
> Hi,
>
> It is possible and how to set Audit so I can log which user at which
> workstation delete an file or folder?
>
> Thank,
>
> S.
>
>
|
|
Posted by Imhotep on June 15, 2005, 11:28 am
If you were Registered and logged in, you could reply and use other advanced thread options
> Hi,
>
> It is possible and how to set Audit so I can log which user at which
> workstation delete an file or folder?
>
> Thank,
>
> S.
..be forewarned, MS auditing is quite a burden on the OS...
-Im
|
| Similar Threads | Posted | | Security Event Log Performance for File and Folder Auditing | January 26, 2007, 3:59 pm |
| Execute File Auditing on a File Share | April 25, 2007, 11:46 pm |
| Auditing shared folder | April 7, 2008, 1:02 pm |
| Auditing Attempted Shared Folder Access | March 5, 2007, 10:28 am |
| How can I remove the "New Folder" and "Delete" button. | September 22, 2006, 8:29 am |
| Auditing File deletion | April 19, 2006, 3:26 am |
| Auditing / File Security | May 22, 2008, 1:02 pm |
| Filtering the auditing of file access | May 10, 2006, 4:20 am |
| Enable file auditing on many servers | December 22, 2006, 2:21 pm |
| File auditing for MOVED files. | May 30, 2008, 11:26 am |
|
XML site map