hi all, i have a user who managed somehow to delete or move most of the contents of the s drive (which is just a share on the D drive of the server) of course the user is nt owning up to it. Is there a way of proving it was him with some kind of log / audit? Thanks

Hi, Try this http://www.sevenforums.com/tutorials/123362-audit-log-access-shared-folders.html

Hi, You will get the logs if you have enabled auditing policy and Auditing on the shared policy. It will generate the logs in Security Logs of the server provided if it is not overwritten.