I have a .bat file on a Windows 2012 R2 server that is periodically executed to refresh the app pools on an IIS server. From time to time, this operation fails because the file has been deleted (by some unknown source). Are there any built in tools in windows that will allow me to monitor any activity on this file so that I can discover what process is deleting it?
Enable file auditing:
Right Click the File Properties
Select the Security tab
The Advanced button
The Auditing tab
Select the categories of events and access especially delete
The events you specified to be audited will be recorded in the servers event log, pay particular attention to Event ID 4660. The image might be different than your 2012 Server but it's been the same through Windows versions for two decades now and will get you sufficiently started.