Archived from groups: microsoft.public.win2000.security (More info?)
If you were not auditing Delete actions on those files, then
there is no record of when/who. Due to the large volume of
events that could result, auditing of NTFS actions must be
defined according to your needs - there is none in the default.
--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
<somebody@compusmart.ab.ca> wrote in message
news:6351v09gprd8tse3d7pv84rirdsbidvnhd@4ax.com...
> How can one find out when files were deleted? They have since been
> recovered, but it is important to know when (who) deleted them.
>
> Any help is much appreciated
>
> Roger
>
> .
Archived from groups: microsoft.public.win2000.security (More info?)
"Roger Abell" <mvpNOSpam@asu.edu> wrote:
>If you were not auditing Delete actions on those files, then
>there is no record of when/who. Due to the large volume of
>events that could result, auditing of NTFS actions must be
>defined according to your needs - there is none in the default.
Many thanks for the info. NTFS actions are not audited - we'll never
know who did it.
You are about to answer a thread that has been inactive for more than 6 months. If you still wish to proceed, please ensure that your posting is original and does not duplicate or overlap any prior responses to this thread.