Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have 3 user on a Window 2003 Enterprise Server. How would I read the log when 1 user delete folder or file . Help for new bie . Many thanks

share|improve this question
1  
Do you already have file system auditing enabled? –  jscott Oct 14 '11 at 10:30
    
Jscott is correct. Enable object access auditing is the only way. An event of status "success" will be logged in the security event log when the audit event is hit. This does introduce some overhead into i/o latency, so be aware of that. –  mbrownnyc Oct 14 '11 at 10:36

1 Answer 1

As jscott and mbrownnyc stated in their comments, you need to enable object access auditing (Success and Failure) (I'm assuming that you'll want to see both successful and failed attempts to access files and folders) on the server and then you need to add auditing entries on the folders (and/or files) that you want to audit. You can configure the auditing entries by accessing the advanced security settings of the folder properties. If auditing inheritance is not disabled, all of the child folders and files of the parent folder will inherit the auditing entries that you set on the parent folder.

Because auditing will log an event for every successful or failed access to the audited folders and files (by users or processes), you should configure auditing judiciously and sparingly.

share|improve this answer
    
To note, I have delete events (and just delete events) being audited on a few file servers (watching about 300GB of data, ~200,000+ files or so on each server). I haven't had problems, but I didn't hardcore analyze the I/O latency... I also disabled access time updating to the MFT, which may help reduce latency as well. –  mbrownnyc Oct 14 '11 at 12:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.