Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been having problems with some staff deleting folders in a public drive (I don't know if by accident or on purpose), but everyone seems to deny all knowledge of it, so I would like to have a log I can check out in these sort of occasions so I can see who is doing what.

share|improve this question
up vote 4 down vote accepted

Yes, enable file auditing in the Local Security Policy (or better yet domain GPO). It is the "audit object access" option and you can enable successes or failures or both.

Once auditing is enabled, choose which files/folders you want to audit by going to the properties of the folder -> Security tab -> Advanced -> Advanced Security Settings -> Auditing tab. Add the users or groups for which access to the object should be logged.

When something happens, check the security log to see who done it.

share|improve this answer
And enjoy crawling through the hundreds of thousand of entries it generates. – mfinni Jan 25 '12 at 15:39
Which is why you don't want to turn in on for say "everyone" or "authenticated users" on the root of your data volume.... lol good point though - you might check the size of your security log to ensure that it will hold enough data before being overwritten. – Paul Ackerman Jan 25 '12 at 15:42
thanks, I will take those points in mind – Iain Simpson Jan 26 '12 at 13:01
You can avoid crawling through the records by creating an event-based task and launching a powershell script that looks for the specific case you're trying to identify. The script can fire off an email to alert you or perform some other function. Poor man's SIEM. Let me know if you would like an example script to read the security log. – Paul Ackerman Sep 4 '14 at 12:48
You can limit the number of log entries generated. If you just need to track deletion of files/folders - then while adding ACE on Auditing tab, add User group or user to be tracked and in the permissions list just choose Successful/Failed "Delete subfolders and files" or "Delete" permissions. No need to have Full Control selected to track any action performed by the user on the folder/file. – Volodymyr M. Jan 21 at 10:22

I agree with mfinni, not the best way to crawl through hundreds of thousands of log entries... although this is a paid solution, am sure there are open source/ cheaper version. This I've used several times in the past -

share|improve this answer

In our organization we use Connection monitor ( We have about 1000 hostson the network, so users always change or replace files of each other. So of course they come to me with their problems. So now I have the full log, which shows who, when, and what did in shared folders. It's really useful.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.