simple way to track who deleted files on server 2003 box

Question

can you log who deletes files under an Active Directory Domain, the file would have been deleted from a file server (member server on domain). The data was recovered but now am wondering who did it. thanks. gd

Answer 1

You could have used the "Auditing" functionality in Windows to do this, but if you didn't have it configured to begin with then the data is gone. (Even if you did have it configured, you would not have appreciated the amount of unnecessary data it created. Practically speaking, there's no easy way to do what you want.)

Answer 2

Perhaps you can try using PowerAdmin File Sight?

Answer 3

Unless you specifically have auditing enabled, you are likely out of luck. Microsoft has a knowledgebase article describing how to enable object auditing that may be of help going forward.