Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a simple way to log when a file/folder has been deleted or moved. I'm sort of surprised there doesn't seem to be a way within Windows to do this. I see there's several programs out there to do this, what should I go for?

Edit: I'd also like to be able to record which user is doing it, I assume this would come with any auditing program.

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

First you need to enable auditing on the server in question...

Start->Control Panels->Administrative Tools->Local Security Policy

Then, Navigate to Local Policies->Audit Policy.

In there, open "Audit Object Access" and select "Success."

Now, navigate to the root folder of the share, right click, and choose Properties. Click on the security tab, and then click "Advanced."

Change to the "Auditing" tab. Click "Add" and enter the username or groupname whose file access you suspect... "Everyone" will obviously grab everyone. Check off the "Success" checkbox for "Delete Subfolders and Files" and "Delete" option.

Then watch your Security log. Any time anyone deletes a file or folder successfully, it will be logged there.

HTH.

Glenn

share|improve this answer
    
This is it! Didn't know auditing was included, thanks man! –  Geoffrey Aug 27 '10 at 19:35
    
Excellent information. Thank you. –  user187501 Aug 28 '13 at 9:36
add comment

There is something built-in - it's called auditing. You enable it on the fileserver, and then enable it for the actions you care about (success and/or failure on read, delete, etc) on the files or folders you care about.

It's so verbose it's almost useless however. Sorry.

share|improve this answer
    
I was also scratching my head wondering why the built-in Auditing feature wasn't good enough –  Izzy Aug 27 '10 at 18:57
add comment

Hope this helps.

I found a utility that does what you're looking for. http://www.addictivetips.com/windows-tips/monitor-folders-auto-run-apps-or-send-emails-when-changes-occur/

share|improve this answer
    
You should at least name the utility that you're talking about and link to it. This links to some third party review of (what I think is) the utility you're talking about. –  Michael Hampton Aug 31 '13 at 20:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.