How can I audit a file to see who deleted it?

Question

So on one of our servers we have a file that keeps mysteriously getting deleted. What I'd like to do is have a program watch this file and let me know when/how/by whom it gets deleted. We have a backup of the file in question, so its not much trouble to put it back, but it results in downtime on our websites.

Is there software that does this? Something free maybe? OS is Windows Server 2003 SP2 32 bit.

Thanks

Answer 1

You don't need any third party software. You need to turn on object access auditing and set the auditing options on the file(s) and or folder(s) you want to monitor. This article explains the process for Windows XP but it's the same for W2K3.

http://support.microsoft.com/kb/310399

Answer 2

There is auditing built in that might suit your needs - I've not got a 2k3 box to hand at the moment, but from memory you can go to folder properties -> security -> advanced -> auditing and then add in auditing there

Answer 3

I would start with an internal audit of the company. Someone on your staff may be deleting the file, and perhaps causing other harm that you have not yet discovered. Question everyone that has access to the machine in question, and perhaps temporarily remove people's credentials to see if the problem suddenly goes away.