7

I'm looking for a simple way to log when a file/folder has been deleted or moved. I'm sort of surprised there doesn't seem to be a way within Windows to do this. I see there's several programs out there to do this, what should I go for?

Edit: I'd also like to be able to record which user is doing it, I assume this would come with any auditing program.

Geoffrey
  • 273
  • 1
  • 4
  • 12

3 Answers3

7

First you need to enable auditing on the server in question...

Start->Control Panels->Administrative Tools->Local Security Policy

Then, Navigate to Local Policies->Audit Policy.

In there, open "Audit Object Access" and select "Success."

Now, navigate to the root folder of the share, right click, and choose Properties. Click on the security tab, and then click "Advanced."

Change to the "Auditing" tab. Click "Add" and enter the username or groupname whose file access you suspect... "Everyone" will obviously grab everyone. Check off the "Success" checkbox for "Delete Subfolders and Files" and "Delete" option.

Then watch your Security log. Any time anyone deletes a file or folder successfully, it will be logged there.

HTH.

Glenn

Glenn Sullivan
  • 1,368
  • 9
  • 17
1

There is something built-in - it's called auditing. You enable it on the fileserver, and then enable it for the actions you care about (success and/or failure on read, delete, etc) on the files or folders you care about.

It's so verbose it's almost useless however. Sorry.

mfinni
  • 36,144
  • 4
  • 53
  • 86
  • I was also scratching my head wondering why the built-in Auditing feature wasn't good enough – Izzy Aug 27 '10 at 18:57
0

Hope this helps.

I found a utility that does what you're looking for. http://www.addictivetips.com/windows-tips/monitor-folders-auto-run-apps-or-send-emails-when-changes-occur/

user215894
  • 1
  • You should at least name the utility that you're talking about and link to it. This links to some third party review of (what I think is) the utility you're talking about. – Michael Hampton Aug 31 '13 at 20:48