Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In Win2003, how can I trace who delete or modify a file?

share|improve this question

1 Answer 1

You'll need to enable the following GPO Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies -> Audit object access

This will generate a log entry in the security log every time someone does a file operation (among others)

This will generate a ton of logs, you'll probably have to ship them to a machine dedicated to managing logs, or increase the size of your security log.

share|improve this answer
    
Hi, I changed the default log file location, with regedit, to somewhere else, but EventLog seemed loading default file location to continue with work. –  user25414 Jan 15 '10 at 8:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.