I have 3 user on a Window 2003 Enterprise Server. How would I read the log when 1 user delete folder or file . Help for new bie . Many thanks
As jscott and mbrownnyc stated in their comments, you need to enable object access auditing (Success and Failure) (I'm assuming that you'll want to see both successful and failed attempts to access files and folders) on the server and then you need to add auditing entries on the folders (and/or files) that you want to audit. You can configure the auditing entries by accessing the advanced security settings of the folder properties. If auditing inheritance is not disabled, all of the child folders and files of the parent folder will inherit the auditing entries that you set on the parent folder.
Because auditing will log an event for every successful or failed access to the audited folders and files (by users or processes), you should configure auditing judiciously and sparingly.