Windows file deletion auditing

View all page feedback. In this article. We recommend Success auditing to track deletion, creation, modification, and access attempts to network share objects. We recommend Success auditing to track deletion, creation, modification and access attempts to network share objects. Expand "Windows Logs" and check the box next to "Security".

Click the drop down menu again to collapse it. Click "OK" to save the settings. Change the name of the view to something you will remember, like "File Deletion Audit", then click "OK". Using the filtered custom event viewer, access information about all files deleted from the shared folder.

Created events will include the following information:. The account user that deleted the file. The date and time the file was deleted. The name and location of the file deleted. Consolidating files so they can be shared to multiple users is a great way to provide access to those files without suffering file duplication or version issues. However, files deleted from shares are permanently deleted with no way to recover those files unless a backup system is in place.

To track who deletes shared files, follow the 3 steps above. With this information, you can direct further education about how shared files work and caution users about deleting shared files.

First - Enable file deletion auditing for shared files Navigate to the folder being shared. Security tab properties of the Shared folder. Where to add an audit entry for a specific folder. In the new Auditing entry, click the "Select a principal" link at the top. Configurations available when customizing an audit entry. Adding the Everyone group to an audit entry so everyone deleting files is tracked.

The following image shows files and folders deletion report. You can see all necessary information related to files and folders deletion in a single line record. All necessary information like who changed which permission, when and where is given in a single line record.

These reports are available both in grid view and graph view. In this article, you have seen how to track files and folders deletion and permission changes. You have also seen an easier alternative of doing the same with Lepide File Server Auditor.

Now, we need to enable the object audit feature on the desired files and folders. Second, right click on the folder and select the Properties option. On the Properties screen, access the Security tab and click on the Advanced button.

On the new screen, click on the Select a principal option. Enter the group named Everyone and click on the Ok button. On the Advanced permissions area, click on the Show advanced permissions option. Click on the Ok button to close the Windows. Click on the Ok button. Reboot the computer to enable the Object audit group policy. You have finished the required object audit configuration. Tutorial - Who deleted my file? You have finished the creation of the GPO.

But, you still need to learn how to discover who deleted your files. First, let's create a text file named TEST. Now, delete the TEST.