1

We just had an incident where some random files were deleted on the server. I've setup auditing now, but since I'm just a developer I want to make sure I got it right:

  • In folder security tab, clicked advanced/auditing
  • Entered user "Everyone"
  • Checked "Delete" and "Delete subfolders and files"

The files should (almost) never be deleted so I expect this audit not to have an impact on performance of this file server.

These audits - they should be in eventvwr/Security, right?

I'm sorry if the question is too easy, but I absolutely have to have this right...

1 Answer 1

3

Spot on!, http://technet.microsoft.com/en-us/library/cc784387%28WS.10%29.aspx

You just need to specify if you want to audit the Successful deletion, or the failure to delete, or both. Both shows lots of event logs, but is useful tracking down malicious users, or buggy utilities.

Please note: Before setting up auditing for files and folders, you must enable object access auditing by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited.

2
  • Thanks! I got no error so it means it's ok. Good links btw
    – veljkoz
    Sep 8, 2010 at 12:49
  • this link is helpful as the ms links are now archived as a 30,000 page .pdf
    – sam-6174
    Sep 15, 2016 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .