locked
How do i know who deleted file/folder in Windows 7 ? RRS feed

  • Question

  • Someone deleted files from Windows 7,i do not know it is remote or local.

    I want to know how was deleted ?

    And can i know what anybody doing (delete,add anything and etc.) on Windows 7 ?

    Thursday, May 22, 2014 10:24 AM

Answers

  • Unless you configured auditing beforehand, there is no way to find out who deleted specific files.

    http://technet.microsoft.com/en-us/library/cc771070.aspx


    MCP/MCSA/MCTS/MCITP

    • Marked as answer by Mozzalan Saturday, May 24, 2014 6:01 AM
    Thursday, May 22, 2014 1:48 PM
  • You need to enable auditing from either local policies or domain policies and apply it to the machine . you need to configure auditing on everything, you want to audit. Please following the given steps:

    1.Configure audit object access in AD Group Policy or on the server's local GPO.

    Computer Configuration --> Windows Settings --> Security Settings --> Local Policies --> Audit Policy --> Audit object Access

    Once that is in place, go to the folder you want to monitor, right click and go to properties

    2. Configure an audit entry on the specific folder's that you want to audit. Right-click on the folder-->Properties-->Advanced. From the Auditing tab, click Add and then enter the users/groups whom you want to audit and what actions you want to audit - auditing Full Control will create an audit entry every time anyone opens/changes/closes or deletes a file, or you can just audit for delete operations. You are now auditing that folder. You will need to monitor the event logs for the particular events.


    Friday, May 23, 2014 9:01 AM

All replies