does any know why I can find information on auditing file deletion? I need to know who is deleting the files and who opened the file. I have turned on all the features of windows auditing but it gives me too much and none of what I want. Please help!

Start here: http://www.windowsitpro.com/Articles/Index.cfm?ArticleID=14761&DisplayTab=Article And then it's a good idea to setup a custom view in server manager for the specifik event id's you want.

File auditing has been turned on for both the domain as well as for the directory that I want to audit. The problem is that it is not pick up open file, delete file, or edit file. It does pick the creation of new files and folders within that directory.

And you have edited the SACL for the objects?

This is for 2000 but still describes how to do it.http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/localpol/w2kadm11.mspx

And here's another one:http://www.pluralsight.com/wiki/default.aspx/Keith.GuideBook/HowToAuditAccessToFiles.html

There is another good article which describes how to turn on the right auditing and log the outputs using 3rd party Software: http://www.monitorware.com/Common/en/Articles/audit_file_deletion.php

set auditing in default domain controller policy

FileAudit will do the job Buzzmann38!Franois Amigorena President & CEO IS Decisions (Security Software) http://www.isdecisions.com