Hi all Someone either was trying to be a pain or to help by doing some cleaning in some folders on my server and they deleted alot that where needed. I was able to restore them by using the previous versions. I would like to know if there is a way I can find out who was the person that deleted them. Is there any way I can find that out. It is a Dell Poweredge 2600 with Win 2003 Thanks

is file and object auditing enabled? if so look in the security log

I dont think it is enabled. I am not sure how to enable that. Is that the auditing tab that is within the advanced security settings of the shared file properties? If that is it, what do I need to add. Right now it is blank. Do I add the everyone user?

read the entire article but file level auditing is near the end http://articles.techrepublic.com.com/5100-22_11-6028421.html

Hi joeny0706, Thanks for posting here. Yes, this is what window build-in audit feature design for . You may like to enable Object Access–File System audit on these folders, so that you could tracing and find out which account were used to delete these files. However , appropriate NTFS permission planning and assignment and effective backup is the best way to prevent this issue happened again. Audit Policy http://technet.microsoft.com/en-us/library/cc766468(WS.10).aspx File server role: Configuring a file server http://technet.microsoft.com/en-us/library/cc780253(WS.10).aspx Thanks. Tiger LiPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.