Click here to get back home

Deleted files
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Deleted files Massblue 07-18-2006
---> Re: Deleted files Arek Iskra [MVP...07-18-2006
Posted by Massblue on July 18, 2006, 7:50 am
Please log in for more thread options
 Hey people, anyone know how to check who deleted files from a network share,
The permissions allow all users to delete files within folders, someone has
managed to delete various files all over the place within a major project
folder.
I have managed to restore the project from backups and Winundelete
Only thing i that the files were on a NAS and i have no idea where to look
to find who deleted the files.
Help please...

Posted by Arek Iskra [MVP] on July 18, 2006, 10:13 am
Please log in for more thread options
> Hey people, anyone know how to check who deleted files from a network
> share,
> The permissions allow all users to delete files within folders, someone
> has
> managed to delete various files all over the place within a major project
> folder.
> I have managed to restore the project from backups and Winundelete
> Only thing i that the files were on a NAS and i have no idea where to look
> to find who deleted the files.
> Help please...


Unless you have enabled audit of object access, the chances are slim.

--
Arek Iskra
MVP for Windows Server - Software Distribution



Posted by Karl Levinson, on July 18, 2006, 6:55 pm
Please log in for more thread options

"Arek Iskra [MVP]" wrote:

> > Hey people, anyone know how to check who deleted files from a network
> > share
>
> Unless you have enabled audit of object access, the chances are slim.

Agreed. Here's how you enable auditing, in preparation for the next time
this happens:

http://www.securityadmin.info/faq.asp?auditing

Note that enabling file auditing is a two-step process: enable auditing on
the system, then on the files and folders you want to audit. Be careful
about enabling success auditing [such as "file delete - success"], as this
can cause a lot of log entries.

--
kind regards,
Karl Levinson, CISSP, CCSA, MCSE [MS MVP]
-------------------------
Microsoft Security FAQ:
http://www.securityadmin.info


Similar ThreadsPosted
solution required; Someone accidentally or intentionally deleted some files and folders from network resource. June 19, 2007, 4:47 am
How to prevent deleted directories August 2, 2005, 12:26 pm
How do I tell which user deleted a file? December 13, 2006, 12:37 pm
Audit policy problem (deleted file name) May 28, 2007, 7:21 am
Audit files July 11, 2005, 11:30 am
Allow access to only certain files. September 15, 2005, 5:13 pm
Disappearing .doc files March 29, 2006, 3:04 pm
Files and Folders April 3, 2006, 4:40 am
Hotmail, Doc and PDF files January 2, 2008, 12:08 pm
running .bat files January 9, 2008, 11:00 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap