1

We just had an incident where some random files were deleted on the server. I've setup auditing now, but since I'm just a developer I want to make sure I got it right:

  • In folder security tab, clicked advanced/auditing
  • Entered user "Everyone"
  • Checked "Delete" and "Delete subfolders and files"

The files should (almost) never be deleted so I expect this audit not to have an impact on performance of this file server.

These audits - they should be in eventvwr/Security, right?

I'm sorry if the question is too easy, but I absolutely have to have this right...

3

Spot on!, http://technet.microsoft.com/en-us/library/cc784387%28WS.10%29.aspx

You just need to specify if you want to audit the Successful deletion, or the failure to delete, or both. Both shows lots of event logs, but is useful tracking down malicious users, or buggy utilities.

Please note: Before setting up auditing for files and folders, you must enable object access auditing by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited.

| improve this answer | |
  • Thanks! I got no error so it means it's ok. Good links btw – veljkoz Sep 8 '10 at 12:49
  • this link is helpful as the ms links are now archived as a 30,000 page .pdf – user2426679 Sep 15 '16 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.