1) Enable auditing via policy
Click Start->Run->secpol.msc
Under Local Policies \ Audit policy, enable "Audit object access" for 'success' events (means that the access was 'successful' - failures would indicate permission problems to do so
Click Start->Run->secpol.msc
Under Local Policies \ Audit policy, enable "Audit object access" for 'success' events (means that the access was 'successful' - failures would indicate permission problems to do so
2) Enable auditing on the 'object'.
Right-click a folder/file
and choose properties
From the security tab, click Advanced
From the Auditing tab,
click Add Now, if you want to find
'who' - it's best to 'add' the Everyone group
For the audit access,
choose Delete, again under Successful (for a successful deletion)
3) Check the events
Open event viewer (Start->Run->Eventvwr)
Look for/filter on the
event ID 560
Comments
Post a Comment