[IT Boy]

Hi,

It is possible and how to set Audit so I can log which user at which
workstation delete an file or folder?

Thank,

S.

[Roger Abell]

You may easily set auditing to record which account deleted
a file or folder. You would need to cross-correlate this account
info with login records to determine from what workstation, and,
you would have to use other means to tie the account use to a user.

To set auditing, in the Auditing policies of the machine where the
file/folder exists, enable the policy setting "Audit object access"
(likely for success and failure). Then, at the filesystem area of
concern access the NTFS Security dialog in the properties of the
folder rooting that NTFS area and click into the Advanced view,
where you would access the Audit tab and define to audit Delete
for Everyone and check to have it applied to all substructure.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"IT Boy" <shingxx@hotmail.com> wrote in message
news:%23fyEJjXcFHA.2288@TK2MSFTNGP14.phx.gbl...
> Hi,
>
> It is possible and how to set Audit so I can log which user at which
> workstation delete an file or folder?
>
> Thank,
>
> S.
>
>

[Karl Levinson, mvp]

See http://securityadmin.info/faq.asp#auditing


"IT Boy" <shingxx@hotmail.com> wrote in message
news:%23fyEJjXcFHA.2288@TK2MSFTNGP14.phx.gbl...
> Hi,
>
> It is possible and how to set Audit so I can log which user at which
> workstation delete an file or folder?
>
> Thank,
>
> S.
>
>

[Imhotep]

IT Boy wrote:

> Hi,
>
> It is possible and how to set Audit so I can log which user at which
> workstation delete an file or folder?
>
> Thank,
>
> S.

...be forewarned, MS auditing is quite a burden on the OS...

-Im