How can I tell who deleted a folder from a public share?

Posted by wizard on Server Fault See other posts from Server Fault or by wizard
Published on 2010-05-11T16:43:46Z Indexed on 2010/05/11 16:55 UTC
Read the original article Hit count: 188

Filed under:

auditing

|

active-directory

|

windows-server-2003

Like a lot of offices we have a few public shares for different teams to save their data. Today I helped someone restore some folders from a shadow copy that had been deleted sometime last week. While I had the shadow copies (and backups elsewhere), I couldn't answer the obvious first question.

"Who deleted the files?"

We're running Windows 2003 server, everyone has active directory accounts.

© Server Fault or respective owner

Related posts about auditing

Unified Auditing - Das neue Auditing in Oracle Database 12c

as seen on Oracle Blogs - Search for 'Oracle Blogs'
In Datenbanken werden fast immer vor allem wichtige Informationen abgelegt. Der Zugriff darauf unterliegt in der Regel gesetzlichen oder betrieblichen Auflagen. Weil der Nachweis, dass diese Auflagen eingehalten werden, ausschliesslich über das Auditing möglich ist, ist eine Datenbank ohne Auditing… >>> More
What tool or scripts do you use to audit a Linux box?

as seen on Server Fault - Search for 'Server Fault'
I use the following tools for my auditing needs A) System Auditing and Hardening (One time) 1) Linux Security Auditing Tool (Security centric,Text based output ) 2) Dmidecode ( Retrieves info from BIOS ) 3) Systeminfo ( Generates a nice html report) 4) Syssumm (Inactive since Oct 2000) 5) Rootkit… >>> More
Database Level Auditing with Microsoft SQL Server 2008

as seen on Internet.com - Search for 'Internet.com'
MAK shows us how easy it is to create a database level audit, test the audit and retrieve the audit records in Microsoft SQL Server 2008. >>> More
Setting default auditing as recommended by Oracle

as seen on Internet.com - Search for 'Internet.com'
If you dont know where to start when setting Oracle auditing parameters, just start with what Oracle recommends. In this article, we set the default auditing as recommended by Oracle. >>> More
Oracle 11g Security &#150; Guidelines for Auditing

as seen on Internet.com - Search for 'Internet.com'
Oracle focuses on the default settings for just about all of the security setup in "The Oracle 2-Day Security Guide". As we draw near the close of the book, we'll examine a few guidelines for auditing. >>> More

Related posts about active-directory

Can't join OS X Mavericks to AD Domain

as seen on Server Fault - Search for 'Server Fault'
I'm attempting to join an OS X Mavericks (10.9) client to a Windows Server 2008 Active Directory domain, however the bind fails with this error in the OS X client's system.log: Oct 24 15:03:15 host.domain.com com.apple.preferences.users.remoteservice[5547]: -[ODCAddServerSheetController handleOtherActionError:… >>> More
Retrieve user details from Active Directory using SID

as seen on Server Fault - Search for 'Server Fault'
Hi, How can I find a user in my AD when I have his/her SID. I don't want to rely on other attributes, since I am trying to detect changes to these. Example: I get a message about a change to user record containing: Message: User Account Changed: Target Account Name: test12 Target… >>> More
Retrieve user details from Active Directory using GUID

as seen on Server Fault - Search for 'Server Fault'
Hi, How can I find a user in my AD when I have his/her GUID. I don't want to rely on other attributes, since I am trying to detect changes to these. >>> More
Retrieve user details from Active Directory using GUID [closed]

as seen on Super User - Search for 'Super User'
Hi, How can I find a user in my AD when I have his/her GUID. I don't want to rely on other attributes, since I am trying to detect changes to these. >>> More
Office365 DirSync Active Directory Integration

as seen on Server Fault - Search for 'Server Fault'
I am preparing to deploy Office365 for my organization. We have an on premise Active Directory Domain Controller (Windows Server 2012 R2). We would like to leverage our Active Directory for: automatic user provisioning in Office365, and password synchronization, using the DirSync tool. Our Active… >>> More