Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a simple way to log when a file/folder has been deleted or moved. I'm sort of surprised there doesn't seem to be a way within Windows to do this. I see there's several programs out there to do this, what should I go for?

Edit: I'd also like to be able to record which user is doing it, I assume this would come with any auditing program.

share|improve this question
up vote 7 down vote accepted

First you need to enable auditing on the server in question...

Start->Control Panels->Administrative Tools->Local Security Policy

Then, Navigate to Local Policies->Audit Policy.

In there, open "Audit Object Access" and select "Success."

Now, navigate to the root folder of the share, right click, and choose Properties. Click on the security tab, and then click "Advanced."

Change to the "Auditing" tab. Click "Add" and enter the username or groupname whose file access you suspect... "Everyone" will obviously grab everyone. Check off the "Success" checkbox for "Delete Subfolders and Files" and "Delete" option.

Then watch your Security log. Any time anyone deletes a file or folder successfully, it will be logged there.



share|improve this answer
This is it! Didn't know auditing was included, thanks man! – Geoffrey Aug 27 '10 at 19:35
Excellent information. Thank you. – user187501 Aug 28 '13 at 9:36

There is something built-in - it's called auditing. You enable it on the fileserver, and then enable it for the actions you care about (success and/or failure on read, delete, etc) on the files or folders you care about.

It's so verbose it's almost useless however. Sorry.

share|improve this answer
I was also scratching my head wondering why the built-in Auditing feature wasn't good enough – Izzy Aug 27 '10 at 18:57

Hope this helps.

I found a utility that does what you're looking for.

share|improve this answer
You should at least name the utility that you're talking about and link to it. This links to some third party review of (what I think is) the utility you're talking about. – Michael Hampton Aug 31 '13 at 20:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.