Auditing file deletions...HELP

[Jim]

Archived from groups: microsoft.public.windowsnt.misc (More info?)

have a customer that is running NT 4.0 Server. They have
a shared directory with subdirectories(by user)
underneath. We turned auditing on for this shared
directory. Files are getting deleted. sometimes whole
folders but the security log isn't showing who removed it
(or i'm just not reading it right). Any suggestions on
the best way to audit files that are getting deleted!
Help. Thanks you.

 

[Guest]

Archived from groups: microsoft.public.windowsnt.misc (More info?)

jim wrote:
>
> have a customer that is running NT 4.0 Server. They have
> a shared directory with subdirectories(by user)
> underneath. We turned auditing on for this shared
> directory. Files are getting deleted. sometimes whole
> folders but the security log isn't showing who removed it
> (or i'm just not reading it right). Any suggestions on
> the best way to audit files that are getting deleted!
> Help. Thanks you.

To audit filesystem activity, you need to turn on auditing in 2 places:
in user manager and in the properties of the folder.
--
Ricardo M. Urbano
Microsoft Windows 2000/NT MVP