Comments on: Use auditing to track who deleted your files http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/ Windows Network Administration Software Fri, 10 Feb 2012 16:32:39 +0000 hourly 1 http://wordpress.org/?v=3.1.2 By: IT Pro Doc http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-3739 IT Pro Doc Fri, 09 Sep 2011 00:33:23 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-3739 Use Netwrix. You'll have to pay for it though. The file/folder monitoring starts at $85 per server. Use Netwrix. You’ll have to pay for it though. The file/folder monitoring starts at $85 per server.

]]> By: Rod http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-1282 Rod Mon, 10 Jan 2011 15:44:29 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-1282 This shit does not work. It just fills my sec.event log with events 560 and 562 but it does not tell me the folders I deleted. This shit does not work. It just fills my sec.event log with events 560 and 562 but it does not tell me the folders I deleted.

]]> By: Steve Wiseman http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-733 Steve Wiseman Thu, 03 Jun 2010 17:18:32 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-733 Awesome - Thanks for the link! Awesome – Thanks for the link!

]]> By: Brian B http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-732 Brian B Thu, 03 Jun 2010 17:10:26 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-732 JC posted the wrong KB: http://support.microsoft.com/kb/325898 will tell you how to turn on auditing for the server, then you will need to follow the above blog post for a particular folder. JC posted the wrong KB: http://support.microsoft.com/kb/325898 will tell you how to turn on auditing for the server, then you will need to follow the above blog post for a particular folder.

]]> By: JC http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-230 JC Thu, 25 Mar 2010 18:48:16 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-230 auditing needs to be on in two places. server (an Mark indicates) and file/folder (as this article describes). look for 560 (has file name) and 564 (delete confirmation) together to confirm the delete. http://support.microsoft.com/kb/174074 auditing needs to be on in two places. server (an Mark indicates) and file/folder (as this article describes). look for 560 (has file name) and 564 (delete confirmation) together to confirm the delete.
http://support.microsoft.com/kb/174074

]]> By: Mark http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-229 Mark Wed, 03 Mar 2010 17:00:37 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-229 Did you disable auditing via group policy? That would cause auditing to fail if configured locally. Did you disable auditing via group policy? That would cause auditing to fail if configured locally.

]]> By: jojiepl01 http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-228 jojiepl01 Wed, 17 Feb 2010 10:33:38 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-228 My concern is to monitor who, what and when a certain file/s was deleted in a shared folder inside a domain controlled invironment. I have done the above instruction with the CPU that has the shared folder (local) and tried it by copying and deleting files inside the monitored shared folder from a remote CPU with an iterval of 10 sec from copying to deleting. Then i went back to the local computer and open the local event viewer. Their was no 560 in the Event ID during that time, most are 538 and 540. Is there any thing else that i may have left undone, or should i do something more in configuring this utility. This is a very hekfull utility and i realy would like to use it, Please help. Thanks in advance, jojie My concern is to monitor who, what and when a certain file/s was deleted in a shared folder inside a domain controlled invironment. I have done the above instruction with the CPU that has the shared folder (local) and tried it by copying and deleting files inside the monitored shared folder from a remote CPU with an iterval of 10 sec from copying to deleting. Then i went back to the local computer and open the local event viewer. Their was no 560 in the Event ID during that time, most are 538 and 540. Is there any thing else that i may have left undone, or should i do something more in configuring this utility. This is a very hekfull utility and i realy would like to use it, Please help.

Thanks in advance,

jojie

]]> By: Francesco http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-227 Francesco Fri, 12 Feb 2010 08:18:32 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-227 Pay attenction that this log is write also if you create a folder. Where you read delete is the type pd permission not the action that the users made Pay attenction that this log is write also if you create a folder. Where you read delete is the type pd permission not the action that the users made

]]> By: Andy http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-226 Andy Sat, 19 Dec 2009 01:04:23 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-226 Thanks Steve! Thanks Steve!

]]> By: Steve Wiseman http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/comment-page-1/#comment-225 Steve Wiseman Sat, 19 Dec 2009 00:32:20 +0000 http://intelliadmin.wordpress.com/2008/03/21/use-auditing-to-track-who-deleted-your-files/#comment-225 I don't think there is any way to know who deleted it. Without auditing turned on, there are no logs of who deleted the file. I don’t think there is any way to know who deleted it. Without auditing turned on, there are no logs of who deleted the file.

]]>