Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On one of our servers we have a file that keeps mysteriously getting deleted. What I'd like to do is have a program watch this file and let me know when/how/by whom it gets deleted. We have a backup of the file in question, so it's not much trouble to put it back, but it results in downtime on our websites.

Is there software that does this? Something free maybe? OS is Windows Server 2003 SP2 32 bit.

share|improve this question
up vote 14 down vote accepted

You don't need any third party software. You need to turn on object access auditing and set the auditing options on the file(s) and or folder(s) you want to monitor. This article explains the process for Windows XP but it's the same for W2K3.

share|improve this answer

There is auditing built in that might suit your needs - I've not got a 2k3 box to hand at the moment, but from memory you can go to folder properties -> security -> advanced -> auditing and then add in auditing there

share|improve this answer

There are a number of programs that can help you with that:

  • Power Admin's PA File Sight
  • Netfort's LANGuardian
  • ISDecisions' FileAudit
  • NetWrix File Server Change Reporter

among others.

share|improve this answer

I would start with an internal audit of the company. Someone on your staff may be deleting the file, and perhaps causing other harm that you have not yet discovered. Question everyone that has access to the machine in question, and perhaps temporarily remove people's credentials to see if the problem suddenly goes away.

share|improve this answer
While I admire your finely-tuned paranoia, this is probably the last step (if at all), after a nice bit of file auditing. User-screwup witch-hunts by IT are rarely appreciated. – Kara Marfia Sep 1 '09 at 17:59
Just tried this - I think I made some enemies now. – dubRun Sep 1 '09 at 18:12
@dubRun double LOL :) – drAlberT Sep 1 '09 at 18:13
So I guess my answer is the accepted answer? – Zimmy-DUB-Zongy-Zong-DUBBY Sep 1 '09 at 18:18
Sorry, I didn't get any results from this answer - just enemies. Jeff in development isn't too happy with my interrogation techniques – dubRun Sep 1 '09 at 18:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.