Auditing file deletions...HELP

Archived from groups: microsoft.public.windowsnt.misc (More info?)

jim wrote:
>
> have a customer that is running NT 4.0 Server. They have
> a shared directory with subdirectories(by user)
> underneath. We turned auditing on for this shared
> directory. Files are getting deleted. sometimes whole
> folders but the security log isn't showing who removed it
> (or i'm just not reading it right). Any suggestions on
> the best way to audit files that are getting deleted!
> Help. Thanks you.

To audit filesystem activity, you need to turn on auditing in 2 places:
in user manager and in the properties of the folder.
--
Ricardo M. Urbano
Microsoft Windows 2000/NT MVP