Home / server / Questions / 61242
Accepted
dubRun
Asked: 2009-09-02 09:45:43 +0800 CST

How can I audit a file to see who deleted it?

  • 772

On one of our servers we have a file that keeps mysteriously getting deleted. What I'd like to do is have a program watch this file and let me know when/how/by whom it gets deleted. We have a backup of the file in question, so it's not much trouble to put it back, but it results in downtime on our websites.

Is there software that does this? Something free maybe? OS is Windows Server 2003 SP2 32 bit.

windows-server-2003

4 Answers

  1. Best Answer

    You don't need any third party software. You need to turn on object access auditing and set the auditing options on the file(s) and or folder(s) you want to monitor.

    • 16

  2. There is auditing built in that might suit your needs - I've not got a 2k3 box to hand at the moment, but from memory you can go to folder properties -> security -> advanced -> auditing and then add in auditing there

    • 0

  3. There are a number of programs that can help you with that:

    • Power Admin's PA File Sight
    • Netfort's LANGuardian
    • ISDecisions' FileAudit
    • NetWrix File Server Change Reporter

    among others.

    • 0

  4. I would start with an internal audit of the company. Someone on your staff may be deleting the file, and perhaps causing other harm that you have not yet discovered. Question everyone that has access to the machine in question, and perhaps temporarily remove people's credentials to see if the problem suddenly goes away.

    • -3