Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We just had an incident where some random files were deleted on the server. I've setup auditing now, but since I'm just a developer I want to make sure I got it right:

  • In folder security tab, clicked advanced/auditing
  • Entered user "Everyone"
  • Checked "Delete" and "Delete subfolders and files"

The files should (almost) never be deleted so I expect this audit not to have an impact on performance of this file server.

These audits - they should be in eventvwr/Security, right?

I'm sorry if the question is too easy, but I absolutely have to have this right...

share|improve this question
up vote 3 down vote accepted

Spot on!,

You just need to specify if you want to audit the Successful deletion, or the failure to delete, or both. Both shows lots of event logs, but is useful tracking down malicious users, or buggy utilities.

Please note: Before setting up auditing for files and folders, you must enable object access auditing by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited.

share|improve this answer
Thanks! I got no error so it means it's ok. Good links btw – veljkoz Sep 8 '10 at 12:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.