Steven
Thu Sep 14 18:46:07 CDT 2006
You can do that but you don't want to as it can severely bog the computer
down with all that logging. You can however audit specific folders for
deletion permissions for success. First you need to enable auditing of
object access on the computer that has the files in Local Security Policy or
whatever Group Policy is enforcing auditing, then audit the folder for ONLY
the users/groups and permissions you want to audit. Avoid auditing read and
list if possible as you want to minimize the object access events in the
security log which will be very substantial. Increase the size of the
security log to like 50MB. To help sort through all the object access events
use Event Comb from Microsoft that allows you to search for specific event
IDs and text strings such as file names and delete, etc. The links below may
be helpful.
Steve
http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
http://www.microsoft.com/technet/security/topics/auditingandmonitoring/securitymonitoring/smpgch02.mspx
--- info on Event Comb
"CJ" <CJ@discussions.microsoft.com> wrote in message
news:65FDB919-CB1F-4AEC-8CBB-4F24A684EDA1@microsoft.com...
>I was curious if there is a way to log every file and folder change by
>every
> user. I have users deleting files and I wan't to know who is doing it. I
> don't want to change the security permissions, I just want to see who is
> deleting files and when.
>
> Thanks