Re: [ActiveDir] OT: Tracking File Deletes

[Za Vue]

Enable AUDITING on the folder and when someone deletes a file/folder you will get something similar below. ***************************************************************************************** Event Type:    Success Audit Event Source:    Security Event Category:    Object Access Event ID:    560 Date:        2/8/2006 Time:        12:24:41 PM User:        DOmain\username Computer:    Domain Description: Object Open:      Object Server:    Security      Object Type:    File      Object Name:    C:\Software\NetDiag.log      Handle ID:    348      Operation ID:    {0,15535362}      Process ID:    4      Image File Name:         Primary User Name:    THEO2$      Primary Domain:    Domain      Primary Logon ID:    (0x0,0x3E7)      Client User Name:    username      Client Domain:    Domain      Client Logon ID:    (0x0,0xEB26BD)      Accesses:    DELETE             ReadAttributes                  Privileges:    -      Restricted Sid Count:    0      Access Mask:    0x10080 ************************************************************************************ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/