Audit file deletion windows 2000

Figure A You can audit a number of events. Figure C You can audit a number of different access types for files and folders. Figure D This is what the security log looks like. Editor's Picks. Enter the name of the deleted file and click on the Find button. You will find an event viewer ID with the details of the deleted file.

In our example, we detected that the TEST. TXT file was deleted by the Administrator. Related Posts. January 4th, September 2nd, August 2nd, July 30th, July 29th, July 13th, July 11th, July 10th, July 8th, July 7th, Now we need to create some basic rules and filter to preprocess the event log entries. We only want to process Events with ID While examining the event log I noticed that there are multiple Events generated with ID for each file deletion.

We do not want to process these events, so we add a filter to avoid these. A few more rules are needed in order to post process the username and domain of the user who deleted the file. If a user deletes a file on the local system, Param8 and Param9 will hold the username and domain which we need to log. If a user deletes a file on a remote system, Param11 and Param12 is important to us.

Please import the configuration sample to see the actions in detail. The other two rules will be used to check if Param11 and Param 12 are empty, so not set with a useful value.

Using this method, we can be sure to always know exactly who deleted the file. The most common way to store logged operations like this is to use write a logfile. As you can see, you can now define your own line format. In our example, I have chosen a rather simple file format, where the values are separated by comma. So you might load them into Excel later, or another other application which can load csv files.

Review the report:. Regularly Audit File Deletion to Prevent Business Disruptions If a file on a server in your domain is deleted, either maliciously or by mistake, users may be unable access critical information they need, causing important business processes to come to a halt. Previous How-to. We use cookies and other tracking technologies to improve our website and your web experience.

To learn more, please read our Privacy Policy.