dear all we have a file server and some files deleted so after search i found articals to enable audit so after follow the steps still no log apper to me to see who delet what? my server 2003 in domian i enable audit through local policy on the server NOT from group policy on domian the event 560 is :. Object Open: Object Server: Security Object Type: Key Object Name: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Security Handle ID: 596 Operation ID: {0,210561049} Process ID: 3132 Image File Name: C:\WINDOWS\system32\mmc.exe Primary User Name: hmostafa Primary Domain: STAFF Primary Logon ID: (0x0,0xBCA723F) Client User Name: - Client Domain: - Client Logon ID: - so can any body help me to resolve this issue

Here you go :http://support.microsoft.com/kb/841001Regards, Ravikumar P

Hello Mostafa, Local Policy are override by Domain Policy, this is probably the reason for the error.Danilo Gonalves | MCSA | Windows Server 2008 R2 and MCITP - Virtualization Administrator

Hello Mostafa, Local Policy are override by Domain Policy, this is probably the reason for the error.Danilo Gonalves | MCSA | Windows Server 2008 R2 and MCITP - Virtualization Administrator