2

I have a .bat file on a Windows 2012 R2 server that is periodically executed to refresh the app pools on an IIS server. From time to time, this operation fails because the file has been deleted (by some unknown source). Are there any built in tools in windows that will allow me to monitor any activity on this file so that I can discover what process is deleting it?

Improve this question
1

1 Answer 1

Reset to default
4

Enable file auditing:

  1. Right Click the File Properties

  2. Select the Security tab

  3. The Advanced button

  4. The Auditing tab

  5. Select the categories of events and access especially delete

The events you specified to be audited will be recorded in the servers event log, pay particular attention to Event ID 4660. The image might be different than your 2012 Server but it's been the same through Windows versions for two decades now and will get you sufficiently started.

enter image description here

Improve this answer
3
  • 1
    Object access auditing needs to be enabled beforehand.
    – joeqwerty
    Dec 7, 2017 at 18:46
  • @joeqwerty Yeah it does, but isn't it already enabled on 2012, I always had to activate it on NT4, Windows 2000 and 2003 but I thought it was enabled by default in 2007 Server and subsequently since.
    – 123456789123456789123456789
    Dec 20, 2017 at 12:16
  • It's not enabled by default.
    – joeqwerty
    Dec 20, 2017 at 12:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .