Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

can you log who deletes files under an Active Directory Domain, the file would have been deleted from a file server (member server on domain). The data was recovered but now am wondering who did it. thanks. gd

share|improve this question
up vote 1 down vote accepted

You could have used the "Auditing" functionality in Windows to do this, but if you didn't have it configured to begin with then the data is gone. (Even if you did have it configured, you would not have appreciated the amount of unnecessary data it created. Practically speaking, there's no easy way to do what you want.)

share|improve this answer

Perhaps you can try using PowerAdmin File Sight?

share|improve this answer

Unless you specifically have auditing enabled, you are likely out of luck. Microsoft has a knowledgebase article describing how to enable object auditing that may be of help going forward.

share|improve this answer
evan and justin, thanks a lot for the help. gd – user8256 Jun 5 '09 at 16:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.