locked
How can I find who deleted my files? RRS feed

  • Question

  • Hello all.

    In my local network, A user see my share partitions and files then removed them, How can I find who did it?

    THanks.

    Friday, February 13, 2015 6:57 PM

Answers

All replies

  • Hey

    There is option with "Auditing".

    Visit this article :

    https://technet.microsoft.com/en-us/library/cc771395(v=ws.10).aspx


    • Proposed as answer by Susie Long Sunday, February 22, 2015 7:49 AM
    • Marked as answer by Susie Long Wednesday, February 25, 2015 8:40 AM
    Friday, February 13, 2015 7:10 PM
  • This question is duplicated (and answered) in:

    how can track who deleted file/folder from Windows Server 2008

    regards

    • Proposed as answer by Ishmar Friday, February 13, 2015 9:58 PM
    • Marked as answer by Susie Long Wednesday, February 25, 2015 8:40 AM
    Friday, February 13, 2015 9:58 PM
  • You need to enable auditing on file server that will let you track, who deleted the files ?

    You may refer to this informative PDF guide that provides step-wise instructions to enable auditing and track all the critical changes activities into real time : https://gallery.technet.microsoft.com/How-to-enable-File-and-af674be4


    Lepide - Simplifying IT Management

    • Proposed as answer by Susie Long Sunday, February 22, 2015 7:49 AM
    • Marked as answer by Susie Long Wednesday, February 25, 2015 8:40 AM
    Monday, February 16, 2015 11:13 AM
  • Must I enable "Audit" options for Drive or Directory ? Or it is enabled by default? 
    Tuesday, February 17, 2015 3:30 PM
  • Hi,

    Yes, you can configure an audit entry on the specific folder that you wish to audit.(Right-click the file or folder, click Properties, and then click the Security tab. Click Advanced, and then click the Auditing tab.)

    Best regards,

    Susie


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, February 18, 2015 7:45 AM