Hi Everyone, I shared one folder and enable the Audit for everyone(Delete folder & Sub folder). If anyone delete one folder we will find in event viewer>Security. 1)I need what is event ID for this one?. 2)and if anyone remove the share permission of this folder. the incident is stored in event viewer or not? 3)If it not stored in event viewer what is the configuration of this? Regards, Vicky

Hi Vicky, Thanks for posting in Microsoft TechNet forums. We can look up Event ID 4660 - An object was deleted. The information in the thread below might be useful to you: Auditing file share on windows 2008 R2 http://social.technet.microsoft.com/Forums/en/winserversecurity/thread/9e633bad-cda6-4ec4-8f04-c01de57ce767 Regarding permission removal/change, I don't think there is an event auditing that. Regards Kevin

Hi Vicky, Thanks for posting in Microsoft TechNet forums. We can look up Event ID 4660 - An object was deleted. The information in the thread below might be useful to you: Auditing file share on windows 2008 R2 http://social.technet.microsoft.com/Forums/en/winserversecurity/thread/9e633bad-cda6-4ec4-8f04-c01de57ce767 Regarding permission removal/change, I don't think there is an event auditing that. Regards Kevin