ALL, Could someone plz suggest tool for auditing windows file servers(like who creates , deletes or modifies files) TIA

Hi, You can use the [Security Settings\Local Policies\Audit Policy: Audit object access] policy to audit file read, create or delete events. For detailed steps, please refer to this article: Enabling File and Folder Auditing https://msmvps.com/blogs/richardwu/archive/2010/07/16/enabling-file-and-folder-auditing.aspx For more information about Audit Policies, please refer to: Audit Policy http://technet.microsoft.com/en-us/library/cc766468(WS.10).aspx Hope this helps. Regards, Bruce

Thanks Bruce, Are there any tools to audit all windows servers

Hi kashif412, Thanks for your reply. Before we go further, I would like to confirm what you mean by "audit all windows servers". If you need a centralized event log management solution, you can use software solution like SCOM. For more information, please refer to this thread: Centralized event log management http://social.technet.microsoft.com/Forums/en/winservergen/thread/534f4f56-ea8f-4ab6-9221-bc105b1c4844 Regards, Bruce

I would recommend NetWrix File Server Change Reporter (www.netwrix.com) . NetWrix offers a freeware version which will tell you what changes were made to file servers, newly created and recently deleted GPOs, changes made to GPO links and audit policies, software deployments, user desktops, and so on. The enterprise version will tell you who made those changes, when and where.