I have enabled Object level access in event viewer, but i am unable to find the exact date & time, when the user create a file or folder. Do you know, how to find out the time & date in event viewer?? Below are the print-screen attached. Thanks & Regards, Param www.paramgupta.blogspot.com

Hello Param, See this http://www.techrepublic.com/article/step-by-step-how-to-audit-file-and-folder-access-to-improve-windows-2000-pro-security/5034308Regards, Ravikumar P

Hi Param, Below link may help you.... http://sogeeky.blogspot.co.uk/2006/07/how-to-audit-and-track-file-deletions.html Rajesh J S

Following should help Using Windows Auditing to track user activity (By Peter Gubarevich) http://blog.windowsnt.lv/2011/11/15/tracking-user-activity-english/ Tracking a Remote File Deletion Back to the Source (By Ned Pyle) http://blogs.technet.com/b/askds/archive/2009/08/04/tracking-a-remote-file-deletion-back-to-the-source.aspx ThanksRegards, Santosh I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights. Whenever you see a helpful reply, click on Vote As Helpful & click on Mark As Answer if a post answers your question.

Hi, To track files&folders creation please track event 560 on Windows Server 2003 or Window XP (corresponding 4616 for Windows 2008 and Vista and later) in the security log. Please refer to: File System Auditing Window 2003 http://whatevernetworks.com/?p=108 560: Object Open https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=560 A previous similar thread: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/ac375439-e5f1-4252-a553-38feb12e48b6/ Regards, Cicely