Hi, Please note that I have some shared files, and they were deleted, so what am asking is, how would I know who deleted these files! although I can't find them on the audit in the event viewer. I believe there is a command line that can show you each user audit, for delete, access, copy...etc. Please help. Thanks, Abdallah Kheirallah. System Administrator - Al Manhal Company.