Turn on file auditing on network share in server 2008 r2

Question

I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been having problems with some staff deleting folders in a public drive (I don't know if by accident or on purpose), but everyone seems to deny all knowledge of it, so I would like to have a log I can check out in these sort of occasions so I can see who is doing what.

Answer 1

Yes, enable file auditing in the Local Security Policy (or better yet domain GPO). It is the "audit object access" option and you can enable successes or failures or both.

Once auditing is enabled, choose which files/folders you want to audit by going to the properties of the folder -> Security tab -> Advanced -> Advanced Security Settings -> Auditing tab. Add the users or groups for which access to the object should be logged.

When something happens, check the security log to see who done it.

Answer 2

I agree with mfinni, not the best way to crawl through hundreds of thousands of log entries... although this is a paid solution, am sure there are open source/ cheaper version. This I've used several times in the past - http://www.scriptlogic.com/products/change-auditor/