Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Win2003, how can I trace who delete or modify a file?

share|improve this question

You'll need to enable the following GPO Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies -> Audit object access

This will generate a log entry in the security log every time someone does a file operation (among others)

This will generate a ton of logs, you'll probably have to ship them to a machine dedicated to managing logs, or increase the size of your security log.

share|improve this answer
Hi, I changed the default log file location, with regedit, to somewhere else, but EventLog seemed loading default file location to continue with work. – user25414 Jan 15 '10 at 8:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.