We just had an incident where some random files were deleted on the server. I've setup auditing now, but since I'm just a developer I want to make sure I got it right:
- In folder security tab, clicked advanced/auditing
- Entered user "Everyone"
- Checked "Delete" and "Delete subfolders and files"
The files should (almost) never be deleted so I expect this audit not to have an impact on performance of this file server.
These audits - they should be in eventvwr/Security, right?
I'm sorry if the question is too easy, but I absolutely have to have this right...