How to Track File Deletion on a File Server

June 18, 2019 at 12:22 pm Leave a comment

Hi Folks

Anybody wants to enable auditing on their file server , for the purpose of tracking and auditing who has deleted any files or folders , I would recommend the below article.

https://blogs.technet.microsoft.com/askds/2009/08/04/tracking-a-remote-file-deletion-back-to-the-source/

It covers detailed steps on how to enable the Group Policy for auditing and enabling Folder level Auditing parameters. However after enabling the required configuration you need to filter out for the event ID’s 4663,4624,5140, and 4660 in the Security Event Log.

These event ID’s will provide the audit trail for the event.

Entry filed under: Windows. Tags: auditing 2008, file deletion audit.

How to reject emails that tagged as SPAM by spamassassin Choose the right authentication method for your Azure Active Directory hybrid identity solution

Leave a Reply Cancel reply

Enter your comment here...

Fill in your details below or click an icon to log in:

Email (required) (Address never made public)

Name (required)

Website

You are commenting using your WordPress.com account. ( Log Out / Change )

You are commenting using your Facebook account. ( Log Out / Change )

Cancel

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Trackback this post | Subscribe to the comments via RSS Feed

Hope you like it..