Skip to content

Auditing file and directory deletion on WS2003

Featured Replies

Real dumb question :o

I'm trying to figure out who is deleting a directory on a WS2003 box. This box and all clients are on a domain.

I've enabled the auditing of AD objects, and have also gone to the directory and in the sharing / security section set up auditing to log any successful or failed attempts at deleting the directory.

Question is, to which user(s)/group(s) do I put this :confused:

If I do "everyone" or authenticated users? The thing is because I have no idea who is doing it, I don't know which group to specify. Ideally, I want anyone and everyone to be logged.

I don't have access to the domain controller nor have access to any account with domain administrative privileges. I do have a local admin account I can use and can log onto the WS2003 box with that account to set it up. But in my attempts so far with testing, nothing appears to get logged :confused: Maybe there's an inherited policy from higher up that I can't see. :confused:

What's the best practice for this? Scoured google and the like, but can't find any good quality explanations (that don't require credit card numbers to pay for ebooks). :(

edit: as well as the AD account, can I find out which PC the delete command was issued? (we have some accounts domain accounts that are used everywhere so just a name won't help find out where it's happening)

TIA :thumbup:

Create an account or sign in to comment

Recently Browsing 0

  • No registered users viewing this page.

Important Information

Welcome to BRISKODA. Please note the following important links Terms of Use. We have a comprehensive Privacy Policy. We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

Account

Navigation

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.